Over Security

OpenAI introduced two new protections designed to help users and organizations mitigate prompt injection attacks when it launched Lockdown Mode in February.

A senior security analyst shares key lessons, wins, and improvements from completing a CMMC audit to help others prepare effectively.

SecjuiceCON is an online event for infosec and OSINT industry insiders, and we'd love for you to talk to our audience about your wisdom and learnings.

Practical guide to AI vendor vetting, covering key data, security, compliance, and risk questions to assess and manage AI third-party risks.

California’s DROP lets consumers delete data from 1,600+ brokers in one click—but behind the scenes it raises serious security, compliance, and transparency risks.

Contents 1. The Ethical Blueprint: Building Trust in Synthetic Media 1. S - Social Benefit 2. C - Consent 3. A - Accountability 4. N - Non-Deception 5. T - Transparency 2. Putting SCANT into Practice 3. TL;DR Checklist 4. It takes work! 5. AI - Embracing the Human 6. Speaking of ISO 42001 The Ethical Blueprint: Building Trust in Synthetic Media Lots of damage has been done with AI, and to keep from deep-sixing the forward-leaning tone I want in this article, I’ll re

Part 1 of a series on creating information security policies Contents * Security Starts at the Top (or, Governance Makes or Breaks Your Security Program) * Disclaimer * Why Governance Comes First * The Information Security Policy: Setting the Tone * Risk Management: Replace Guesswork with Discipline * Roles and Responsibilities: Eliminating the Accountability Gap * What Auditors Look For * Common Pitfalls to Avoid * Governance as a Force Multiplier * Afterword about Infosec Policy an

Real investigations start with noise, a fragment, a pattern, something that doesn't fit. Almost nothing in the standard training stack teaches you to work that problem. Hashclue is an attempt to build something that does.

Part 2 of a series on creating information security policies Many breaches don’t start with sophisticated hackers; they start with ordinary users doing ordinary things in unsafe ways. Let’s look at 3 ways to work toward helping people in our organizations understand better how to safeguard everyone’s information. Because there are as many ways to create a policy as there are organizations - compounded with the numerous requirements from regulations - I won’t attempt to provide a one-size-fits-

CTFs haven't changed in decades. Better puzzles, same game. The problem isn't technical difficulty, it's that nobody has ever made you commit to anything.

You pulled the threads, mapped the connections, built the timeline. The data looks clean and the narrative holds. Then someone asks a question you didn't consider and the whole picture shifts. The failure was not in your tooling.

The AI agent explosion is happening whether we're ready or not. The companies that take identity seriously now will save themselves a world of pain later.

Part 3 of a series on creating information security policies. Attackers don’t break in…they log in. That’s a bit of a dramatic exaggeration, and it seems cliché, but it’s not really too far off. Consider the 2022 Uber breach. The attacker didn’t exploit a sophisticated vulnerability; they obtained a contractor’s credentials and then bombarded the user with MFA push requests until one was approved. That single moment of fatigue opened the door to internal systems and broader access. Or look a

An introduction to the canine intelligence cell, a volunteer investigative effort focused on exposing the criminal networks exploiting dogs through trafficking, legal loopholes, fraud, violence, and organised abuse.

Malware analysis is more than tools. Learn the mindset, goals, techniques, and workflows analysts need to dissect malware effectively.

Part 4 of a series on creating information security policies. Visibility before Protection Organizations often invest heavily in cybersecurity tools: endpoint protection, firewalls, SIEM platforms, MFA, cloud security solutions, and threat detection services. Unfortunately, many security incidents still come down to a surprisingly simple problem: organizations do not fully understand what they own or where their sensitive data resides. Before an organization can protect its environment, it fi

We replaced ModSecurity with Karna, our open-source WAF engine in Lua and C running as a Kong plugin. CRS-compatible, MCP-aware, can sanitize instead of blocking, and 2 to 4 times faster than ModSecurity in our benchmarks. The honest story of why, how, and how to try it.

We replaced ModSecurity with Karna, our open-source WAF engine in Lua and C running as a Kong plugin. CRS-compatible, MCP-aware, can sanitize instead of blocking, and 2 to 4 times faster than ModSecurity in our benchmarks. The honest story of why, how, and how to try it.