NIS2 in practice: from risk assessment to controls
NIS2 expanded cybersecurity obligations to more organisations. Follow the steps from determining applicability through risk assessment to controls with owners and verifiable results.
Read article
ARTICLES AND GUIDES
Blog
Practical articles on testing, protection and security management, with links to public frameworks and vendor documentation.
NIS2 in practice: from risk assessment to controls
NIS2 expanded cybersecurity obligations to more organisations. Follow the steps from determining applicability through risk assessment to controls with owners and verifiable results.
Read article
Dependencies and SBOM: controlling the software supply chain
Applications rely on third-party libraries. Learn how SBOM inventories, continuous checks and clear update and package selection rules help manage the risks.
3 min read
Ransomware
Ransomware: why antivirus alone is not enough
Endpoint protection matters, but ransomware defence needs more. We review backups, segmentation, identities and response, including the capabilities and limits of rollback.
3 min read
How to read a penetration test report and set remediation priorities
A penetration test report is the start of remediation. Learn to interpret severity in context, assign owners, plan fixes and verify them through retesting.
3 min read
Patching
Patch management in smaller businesses: building a regular routine
Regular updates close known weaknesses. Learn how to establish an inventory, prioritise patches and roll out updates gradually without overwhelming a small IT team.
3 min read
IDOR and API authorisation: a flaw automated scanners often miss
If changing a number in an API request returns someone else's invoice, object-level authorisation is broken. Learn why scanners miss it and how to address it in design and code.
3 min read
Phishing, MFA fatigue and what actually helps
MFA makes stolen passwords harder to abuse, but not every method resists phishing. Explore stronger methods, ways to limit MFA fatigue and why technology and training belong together.
3 min read
EDR a XDR
EDR, XDR and MDR: the differences and what your business needs
EDR, XDR and MDR are often confused. We explain each term, distinguish technology from services and show how to choose around your team's capacity.
3 min read
How to prepare for a penetration test
Good preparation saves time and produces more useful results. Here is what to clarify beforehand: scope, authorisation, Rules of Engagement, test accounts and contacts.
3 min read
INITIAL CONVERSATION, NO OBLIGATION
Not sure where to start? Tell us what you are facing.
You do not need to know whether you need a test, a technology or a consultation. We will suggest a suitable next step based on your situation.