AI security and agents
MCP, LLM agents in production, model supply-chain risk, GenAI browser extensions. What organisations can actually control today, what depends on the provider, and which controls to require by contract.
Cybersecurity Compliance 24/7 SOC AI security Threat hunting
Cybersecurity and compliance blog
Technical breakdowns, practical guides and operational criteria from the Hard2bit team — the same one that runs a 24/7 SOC, handles incident response, executes pentests and supports compliance programmes at mid-market and large organisations.
We publish about the work we run every day. Every article is signed by someone who has been inside the problem, not written by an external copywriter. You'll find technical breakdowns of high-impact CVEs, implementation-focused guides on NIS2, DORA, ENS and ISO 27001, and explanations of which controls actually move maturity forward and which are theatre.
We cover five areas:
- Offensive security pentesting, red team, external attack surface, web and API audits
- Compliance and GRC NIS2, DORA, ENS, ISO 27001, ISO 42001, EU AI Act and third-party risk
- AI security agents, MCP, LLMs, model supply-chain risk, GenAI browser extensions
- Defensive operations managed SOC, MDR, threat hunting, incident response, CTEM
- Current threats campaigns and techniques observed in real engagements: ClickFix, device code phishing, Microsoft 365 account takeover, C2 over Teams, npm supply-chain attacks
No articles match your search. Try another term (for example NIS2, pentesting, SOC, AI) or browse the full blog.
Comparisons and essential guides
When the decision is X or Y: what each option assesses, where they overlap, and when each makes sense. Written to unblock scoping and procurement calls.
- Compliance
ENS vs ISO 27001 vs NIS2 vs DORA
Four frameworks, one control map. What each requires and how to prioritise.
Compare → - Detection
EDR vs XDR vs MDR
Endpoint detection, cross-domain correlation or 24/7 managed service. When to pick each.
Compare → - Operations
In-house SOC vs managed SOC
Real cost, response capability and operational control. When to internalise, when to outsource.
Compare → - Offensive
Pentesting vs red team vs BAS
What each offensive exercise validates and which one the board, auditor or regulator asks for.
Compare → - Governance
Internal CISO vs vCISO
When an in-house CISO makes sense and when a fractional vCISO solves the equation better.
Compare →
Start here — themes and pillar posts
Four areas where the blog concentrates most material. Each block links to the articles that cover the fundamentals and to the equivalent service at Hard2bit.
Offensive security and audits
What each type of offensive exercise actually assesses, what a useful pentest report should deliver, and how external attack surface work differs from a compliance audit.
Threats and incident response
Live campaigns and techniques observed in real engagements. ClickFix, C2 over Microsoft Teams, Microsoft 365 account takeover, npm supply-chain attacks. Vector, indicators and the controls that actually block the technique.
Board-level exposure and supply chain
Boardroom-facing material: exposure dashboards a board can act on, digital supply-chain lessons for the CISO, and continuous exposure management for regulated environments.
Signed by the team
The blog is signed by Hard2bit's founding partners and technical team. Every article carries the byline of someone who has worked the problem in a real engagement — not an external copywriter.
Filter by category
Featured
Featured 
17 Jul 2026 Cyber Threats Compliance & GRC
What services should a cybersecurity company offer in 2026?
What a modern cybersecurity company should really offer: audit, pen testing, managed SOC, cloud and Microsoft 365, identity, incident response and compliance — with a practical, risk-led approach.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Read →
Featured 
01 Jul 2026 Cyber Threats
CVE-2026-42897: the Exchange Server zero-day that triggers when you open an email in OWA
Microsoft has confirmed active exploitation of CVE-2026-42897, an XSS flaw in on-premises Exchange OWA that runs JavaScript the moment a crafted email is opened. What it means and how to contain it.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Read →
Featured 
06 Jun 2026 Research Cybersecurity
AI Agent Readiness in Europe: 0% adoption in 59 large enterprises analysed (2026 report)
Passive analysis of 60 EU domains — banking, pharma, telcos, energy, retail and public sector — against the 11 emerging AI Agent Readiness standards. Aggregated data by sector.
By Adrián González · CEO y socio fundador
Read →
Latest articles
14 Nov 2026 Cyber Threats
November's only exploited Patch Tuesday flaw scores 6.5 and leaks the NTLMv2 hash through Outlook
Microsoft has fixed an exploited Outlook flaw that leaks the user's NTLMv2 hash when a crafted message file is opened. Exposure, detection and interim measures.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Read →
13 Nov 2026 Cybersecurity
The Microsoft 365 outage also hit Defender, Intune and Purview: what to check once service returns
Incident MO1550821 also reached Defender XDR, Intune and Purview. What to review once service returns, where Entra ID stands and when reporting applies.
By Adrián González · CEO y socio fundador
Read →
12 Nov 2026 Cyber Threats
Able2Shell: N-able took N-central offline after 33 flaws were published with exploits
A researcher released attack code for 33 N-central flaws. N-able took its cloud offline and shipped a seven-CVE hotfix, which the same researcher now says he has bypassed.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Read →
10 Nov 2026 Compliance & GRC Cyber Threats
What DORA asks firms to check after the Crédit Mutuel Arkéa theft through a supplier
Attackers came in through a provider's platform and wired money out of one of the bank's own accounts. What DORA requires and which controls firms should test.
By Adrián González · CEO y socio fundador
Read →
10 Nov 2026 Cyber Threats
Chainalysis took five days to go from no sign of exposed credentials to confirming every user's hash and token
On 30 October Chainalysis saw no sign of exposed credentials; by 4 November it confirmed every user's password hash and live token. What customers should check.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Read →
08 Nov 2026 Cybersecurity Cyber Threats
Hardening VMware ESXi and vCenter against ransomware: a 2026 technical guide, plus Proxmox, Hyper-V and Nutanix
Phased controls, esxcli and PowerCLI commands, alerts and backups so that a ransomware attack cannot encrypt all of vSphere, plus what changes in Proxmox, Hyper-V and Nutanix.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Read →
06 Nov 2026 Cyber Threats
CVE-2026-119977 in WordPress: attackers are racing the core update for code execution
A WordPress core flaw lets anyone run code without credentials during the seconds a full update takes. CISA now lists it as actively exploited.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Read →
04 Nov 2026 Cybersecurity Compliance & GRC
Cybersecurity challenges for businesses in 2026-2027: tool sprawl, regulation and shadow AI
International data on security tool sprawl, NIS2, DORA and shadow AI, and when a managed SOC or an MSSP helps to reduce it.
By Adrián González · CEO y socio fundador
Read →
03 Nov 2026 Cyber Threats Cybersecurity
Malicious AI agent skills: what they hide and how to vet a Claude, Codex or Copilot skill before installing it
Skills recommended on social media for Claude, Codex or other agents can carry hidden instructions or malware. The documented cases so far and how to vet a skill before installing it.
By Daniel O'Grady · CIO y socio fundador
Read →
02 Nov 2026 Cyber Threats
Claude Code extension backdoor in Cursor: what happened, how to detect it and how to clean up
Cursor's marketplace served a tampered Claude Code build for about eleven hours, planting an attacker's SSH credential and trying to open a reverse tunnel. Up to 5,000 users were exposed.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Read →
30 Oct 2026 Cyber Threats Compliance & GRC
Binance hack: how USD 6.36 billion left with no sign of leaked keys
An attacker took USD 6.36bn from Binance across ten blockchains with no sign of leaked keys. How the EIP-7702 delegation worked and which controls and DORA duties to review.
By Adrián González · CEO y socio fundador
Read →
30 Oct 2026 Cyber Threats Cybersecurity
An unpatched analytics server put a card skimmer on every Convertr checkout
A Magecart group tampered with the Plausible script Convertr served on its checkouts. How it probably got in, how to detect it and what PCI DSS requirements 6.4.3 and 11.6.1 expect.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Read →
29 Oct 2026 Compliance & GRC Cybersecurity
Who takes the call when an outside agency warns of a compromise? Australia sent more than 4,400 such warnings last year
One ASD alert to 340 organisations led to more than 60 confirmed incidents. Why an external compromise notification needs an owner, a verified channel and a procedure.
By Adrián González · CEO y socio fundador
Read →
28 Oct 2026 Cyber Threats Cybersecurity
How the k0t campaign stole more than 70,000 credentials through FortiGate, FortiWeb and GlobalProtect
Weak FortiGate passwords and FortiWeb and GlobalProtect flaws gave the k0t campaign more than 70,000 credentials. Fortinet and Palo Alto Networks have published fixes.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Read →
27 Oct 2026 Compliance & GRC Cybersecurity
When an AI agent uses a consumer's password, in Europe it is the bank that must prove the payment was authorised
Big US banks are blocking AI agents that log in with customers' credentials. In the EU, for consumers, PSD2 and a new CJEU ruling keep the immediate refund and the burden of proof with the bank.
By Adrián González · CEO y socio fundador
Read →
26 Oct 2026 Cyber Threats
A reused SSH password and Ebury 1.8.3 in the hijack of 333 Tor exit relays
A modified exit policy turned 333 Tor relays into SSH traps. The best-documented case involved Ebury 1.8.3, which ESET's script misses. The article sets out which signals to hunt for.
By Adrián González · CEO y socio fundador
Read →
24 Oct 2026 Cyber Threats Cybersecurity
Storm-0940 and ARTEX: Microsoft ties a China-aligned group to the ConnectWise attack
Microsoft attributes the ConnectWise Cloud Backup attack to Storm-0940 and says it used ARTEX, an AI-agent framework. What the figures measure and what to review in Microsoft 365.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Read →
23 Oct 2026 Cyber Threats Cybersecurity
Why governments and companies on four continents switched off their websites over PHP2Shell
On 21 and 22 October ministries, companies and media outlets took their sites offline as a PHP2Shell precaution. The impact, and what it says about AI and patching.
By Adrián González · CEO y socio fundador
Read →
22 Oct 2026 Cybersecurity
Chrome and Firefox blocked eMudhra's weak CA keys within hours. Servers and containers are another matter
Eight eMudhra intermediates had derivable keys. Chrome and Firefox blocked them within hours; on servers and in containers, Java, Python and Go may each need a separate fix.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Read →
21 Oct 2026 Cyber Threats
Backdoors on up-to-date WordPress sites: Rank Math PRO and stolen UpdraftCentral keys
A tampered Rank Math PRO package and apparently stolen UpdraftCentral keys backdoored patched WordPress sites. What it says about plugin vendor risk, and what to check.
By Adrián González · CEO y socio fundador
Read →
20 Oct 2026 Cyber Threats Cybersecurity
Polymorphic and metamorphic malware: what they are, how they evolved and how to detect them
Polymorphic malware changes its appearance with every copy and metamorphic malware rewrites its code. History, generative AI, why signatures fail and which controls work.
By Daniel O'Grady · CIO y socio fundador
Read →
20 Oct 2026 Cyber Threats
AOMEI Backupper's update servers handed out a backdoor a few minutes at a time
UNC7017 altered two AOMEI Backupper configuration files for minutes at a time and delivered a backdoor in 11 countries, Spain included. How to hunt for it and what 8.5.1 changes.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Read →
19 Oct 2026 Cyber Threats Cybersecurity
ConnectWise Cloud Backup (SkyKick) breach: compromised app credential used against 300+ Microsoft 365 tenants
The backup application once called SkyKick signed in to more than 300 Microsoft 365 tenants from a hosting provider's server, beyond the reach of Conditional Access.
By Adrián González · CEO y socio fundador
Read →
16 Oct 2026 Cyber Threats Compliance & GRC
IDCF Cloud ransomware: 194 of 495 IDC Frontier customers may recover their snapshots
The ransomware attack on IDCF Cloud hit 495 IDC Frontier customers in Japan. Only the 194 using snapshots may recover them, and the rest depend on backups kept elsewhere.
By Adrián González · CEO y socio fundador
Read →
Frequently asked questions
How we publish, who writes, what we cover and how to cite the material.
How often do you publish?
Several articles a month. We refresh the pillar posts (NIS2, DORA, ENS, ISO 27001, pentesting, SOC, AI security) whenever the technique or the regulatory interpretation shifts.
Who writes the articles?
The Hard2bit team: SOC analysts, pentesters, compliance leads and security architects. Every article is signed by someone who has worked the problem in a real engagement, not by an external copywriter.
What topics do you cover?
Offensive security (pentesting, red team, external attack surface), compliance and GRC (NIS2, DORA, ENS, ISO 27001, ISO 42001, EU AI Act), AI security (agents, MCP, LLMs), defensive operations (managed SOC, MDR, threat hunting, incident response) and analysis of live cyber threats.
Are the articles relevant outside Spain?
The technical ones are: CVE analyses, security architecture, AI, threat hunting or pentesting content is transnational. Compliance material focuses on the European regulatory frame (NIS2, DORA, EU AI Act) and on Spanish specifics (ENS). The English edition covers the same topics adapted to the UK/EU context.
Can I link or quote the articles?
Yes, with attribution to Hard2bit and a link to the original URL. For partial reproduction or translation, get in touch and we'll coordinate.