Disabling a leaver's account does not end tokens, app sessions, OAuth grants or SSH keys already issued. Here is what a departing person actually holds, how to time-box exceptions, and a checklist for this week.
Sharing links beat email attachments, until they quietly outlive the project they were made for. Here is how to make external access authenticated, time-limited and reviewed, with a checklist for this week.
Device code phishing gets victims to complete MFA on the genuine sign-in page while the attacker collects the tokens. Here is how the technique works, why passkeys alone do not stop it, and five steps to take this week.
Prompt injection cannot be fully prevented, so the safer question is what a fooled assistant can reach and where it can send it. Here is how to close the exits, with a checklist for this week.
US agencies' post-quantum migration plans are due today under OMB M-26-15. The memo is the clearest public template yet for what a credible plan contains, and any organisation can borrow it. Here is what it asks for and where to start.
A single incident can trigger GDPR, NIS2, DORA and Swiss reporting deadlines at once, each with its own trigger and recipient. Here is how they compare and what to prepare this week.
AI agents often run on shared keys or borrowed user tokens. Recent Five Eyes guidance and emerging standards point to a better model: distinct agent identities, delegated short-lived tokens and a tested off switch. Here is a checklist to start.
Backups only save you from ransomware if attackers cannot delete them, reach their admin console or lock you out of their keys. Here is how to separate all three, with a checklist to start this week.
From 15 March 2027, public TLS certificates may last no more than 100 days. Here is what changes, why it matters for key management, and a checklist to automate renewal now.
Attackers posing as IT support are using passkey and MFA updates as a pretext to take over cloud accounts. The weak point is method registration and recovery. Here is how to harden it and what to check this week.
Since 11 September 2026, the EU Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities and severe incidents within 24 hours. Here is what applies and what to prepare.
NIST and CISA's final token guidance sets clear expectations for signing keys, token lifetimes, audience checks and revocation. Here is what it means for any SSO or API setup, and what to check this week.
The safest useful answer is the one the person asking is already authorized to receive
Tell us about your organization and security needs. Our team will get in touch to explore the right solution for you.
