Three hours into the incident, a phone buzzed with a text from a number nobody recognized. The message did not ask for money. It named the chief information security officer's daughter, it named her school, and it gave the time she usually got dropped off in the morning. Then it went back to the ransom. The chief information security officer is the executive who owns security for the whole company, and that person had spent three hours thinking about servers and backups. The

Picture the operations floor at a busy airport. The radar is up. The radios work. The controllers are at their stations and every system they think of as the job is running exactly like it did yesterday. Then the weather feed goes dark. Not the radar, not the comms, the weather. And without current, trusted weather data, you cannot safely space and sequence aircraft, so the whole operation starts to slow. Ground stops. Holding patterns. Flights backing up across the network b

A 24 year old was arrested in the Netherlands a few weeks back. The FBI calls him a leader of one of the busiest data extortion crews. The same name behind a run of breaches this year that dumped records on millions of people. On its own that's a solid arrest and a slow news day. Then police went through his laptop. Next to the stolen data and the attack tooling, they say they found plans to arrange two murders. That last part is honestly what makes the whole story interestin

We're in South America this week working with a few clients, including a data center build in São Paulo and some time with a defense partner in the Southern Cone. On the way down, a fellow traveler found out what we do and started talking about AI. His view was one we hear constantly now. You ask a model a question, it goes out and pulls everything together, and what comes back is intelligence. It was a good conversation, and a little strange, because he wasn't wrong about wh

We walked a client site last quarter with a HackRF in a backpack and had a decent picture of their operations before we cleared the lobby. Not from their network or from a badge clone, but from the air. Their guard force was keying up on an analog channel in the clear, and inside a few hours we knew their shift changes, patrol timing, and the phrase they used to call the desk. Later in the engagement, we found a device periodically broadcasting that nobody in the building cou

A while back a client brought us in on the rollout of a new service they were proud of, especially their marketing team. They had purchased a large batch of smart TVs to put up across several of their locations. The idea was to have central control over what played on every screen so they could push wait times, new service offerings, and updates to their customers from one place instead of sending someone from IT site to site to update the old marketing displays. They asked u

Give us a parking spot across the street and a few days and we'll know your building better than half the people who badge in every morning. When the shift change happens. Which door gets propped at 1700 so the smokers don't have to walk around from the front door. How many guards actually work a Sunday versus how many the roster says. What sits on the loading dock and how long it sits there before anyone moves it. None of that is clever. It's just patience and a line of sigh

A while back we ran an advance for a principal who was certain his risk started the moment he stepped out his front door. Route was tight. Venue was swept. The detail was sharp and the man leading it was good. Then we asked what was installed on his vehicles and got a shrug. A dealer had bolted an aftermarket alarm under the dash years earlier, nobody on the team knew it was there, and not one person could tell us what it talked to or who else had ever touched its settings. T

Earlier this year attackers went after Amazon's cloud in the Middle East and never touched a server. They used drones. They hit the power and the supporting infrastructure the facilities depend on, damaged nearby systems around Bahrain, and knocked capacity offline across multiple availability zones. No zero-day. No stolen credential. No malware. Just the oldest idea in warfare, which is that you break the thing your enemy leans on and let the rest fall over on its own. We ha

Three hours. That's how long it took to go from standing outside a data center fence to dumping domain credentials from a VSS shadow copy. Not three days. Not three weeks of patient phishing campaigns and careful lateral movement. Three hours, start to finish, in broad daylight. The Setup A client hired us for a physical target assessment of a remote data center. The engagement included a network penetration test component, but with a catch—we only got to touch the network if

It's been a few weeks since my last post. I've been busy. The end of the year always seems to get us. Organizations are scrambling to close out projects that have been lingering for months, budgets are coming to a close, and with that comes an influx of high-priority, short-notice work. Sleep becomes optional. Most of my time has been spent on offensive technical work: external / internal penetration tests and public-facing web application testing. With that comes tool develo

I found this list a few months back while doing disaster operations training. I volunteer with the American Red Cross as a State Relations Disaster Liaison; it's what I do when I'm not doing security work. Some of the training material had this piece of dark satire buried in it, probably aimed at disaster responders or emergency workers. I wish I could remember where exactly it came from so I could credit whoever wrote it. Here's why it stuck with me: I read through it and re

Last week I watched something that happens constantly in our industry. A client's blue team was investigating suspicious traffic. Nothing crazy—just odd patterns in their Splunk. Meanwhile, their red team was two floors up running a pentest using the exact same techniques the blue team was tracking. Nobody told anyone. The teams don't talk. Real attackers don't work in silos. They run automated recon, exploit vulnerabilities in real-time and adapt to your defenses faster than

The threat intelligence lifecycle begins with defining what information you actually need to collect. Intelligence Requirements form a hierarchical framework for organizing and prioritizing information gathering needs within cybersecurity threat intelligence operations. This three-tiered approach—Intelligence Requirements, Priority Intelligence Requirements, and Specific Intelligence Requirements—ensures systematic collection and analysis of relevant threat data throughout th

I'm stepping away from my usual security-focused content today to address something dire that affects every small business owner - something I witnessed firsthand that left me genuinely shaken. I was at a networking event recently with about 30 small business owners. At one point during the presentations, a CPA asked everyone in the room a simple question: "How many of you actively track your profit and loss statements?" Less than half the room raised their hands. Let that si

Last week, I was sitting across from a CISO at a Fortune 500 company when he said something that made me pause: "We're just starting to explore AI for our security operations. It's exciting to think about the possibilities." I had to break some bad news to him. While his team was "exploring possibilities," the attackers targeting his organization had been weaponizing AI for the better part of a decade. Let me share what I've been seeing in the field. The gap between offensive

A practical guide for protecting your business without breaking the bank or hiring an IT team Your Business Is More Vulnerable Than You Think In October 2023, First Choice Dental in Wisconsin discovered that ransomware attackers had encrypted their patient files and were demanding payment to release them. The attackers had gained access to their computer network and stolen personal information from 228,287 dental patients over just two days. The practice had to take their e

90-Day Roadmap with NIST Cybersecurity Framework Maturity Assessment Company Name: _____________________Assessment Date: ___________________Completed By: ______________________ How to Use This Checklist This checklist follows a 90-day implementation timeline and maps to the NIST Cybersecurity Framework (CSF) functions: Identify, Protect, Detect, Respond, and Recover. NIST CSF Maturity Levels: Level 1 - Partial: Ad hoc, reactive security practices Level 2 - Risk Informed: Risk

When you look at what happened to Highlands Oncology Group, you're seeing a textbook example of how security failures compound over time. This Arkansas-based cancer care provider was hit twice in less than two years. The second attack was more than double the size of the first. What makes this case particularly concerning is the pattern we see repeatedly in healthcare. The implementing of tactical fixes after a breach without addressing the underlying security architecture pr

Radio frequency scanning has long been a cornerstone of signals intelligence operations, from World War II codebreaking efforts to modern military and law enforcement surveillance. What was once the exclusive domain of government agencies and sophisticated adversaries has now become accessible to a broader range of threat actors through commercial software-defined radios and readily available scanning equipment. As organizations increasingly rely on radio communications for s