Articles 121 to 137 of 137. To search by keyword, go back to the blog hub.
On 17 June 2026 an attacker pushed more than 140 @mastra npm packages carrying a malicious dependency that runs a trojan during postinstall. What happened, and how to defend against it.
By Irene Ocando · Directora de Cumplimiento Normativo Hard2bit
We ran a 100% passive OSINT scan against 24 well-known brands and found 591 live typosquatting domains. 48% can send email. Anonymised aggregate data, June 2026.
By Adrián González · CEO y socio fundador
ClickFix tricks users into running PowerShell by pasting a command. 517% growth in 2025. Anatomy, operational detection and defences that genuinely work.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Realistic 2026 ranges for cybersecurity audit pricing in the Spanish and EU mid-market, what a professional audit covers and how to choose a serious provider.
By Irene Ocando · Directora de Cumplimiento Normativo Hard2bit
ENISA Threat Landscape 2025 (4,875 EU incidents) and Verizon DBIR 2026 combined: five CISO lessons on supply chain, digital dependencies, vulnerabilities, AI phishing and NIS2.
By Adrián González · CEO y socio fundador
A practical 12-KPI cyber resilience dashboard for the Board: what to measure, how to present it, and how to use it to drive decisions on risk, investment and strategy.
By Adrián González · CEO y socio fundador
SPIFFE/SPIRE for workload identity and OAuth for machine-to-machine: how each works, where each fits, and the hybrid pattern that scales for cloud-native enterprises.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
How to combine CISA KEV, EPSS and SSVC to prioritise exploitable vulnerabilities, replace CVSS-only triage and produce defensible remediation decisions.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
How to implement Continuous Threat Exposure Management (CTEM) in regulated enterprises: five phases, architecture, KPIs, compliance mapping and a 90-day rollout plan.
By Adrián González · CEO y socio fundador
Technical playbook for SOC and IR teams: how to detect, contain and reduce Active Directory abuse in hybrid environments — Kerberoasting, AD CS misconfigurations, Golden Ticket and Entra ID.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Executive guide to preparing the post-quantum transition for European enterprises 2026-2028: cryptographic inventory, prioritisation by impact and feasibility, governance, KPIs and quick wins.
By Adrián González · CEO y socio fundador
How to move AI agents from pilot to secure production with MCP: control architecture, guardrails, security minimums and a phased implementation plan for the enterprise.
By Adrián González · CEO y socio fundador
Non-human identities now outnumber humans in most enterprises. Practical guide to inventory, least-privilege, secret rotation, anomaly detection and a 90-day implementation plan.
By Adrián González · CEO y socio fundador
Traditional MFA isn't enough. Technical analysis of Adversary-in-the-Middle (AiTM) attacks, Evilginx2, ESTSAUTH cookie theft and FIDO2-based mitigation in Microsoft 365.
By Adrián González · CEO y socio fundador
Device-code phishing in Microsoft 365 abuses legitimate OAuth flows to steal tokens without asking for passwords. How it works, warning signs and the controls that actually block it.
By Adrián González · CEO y socio fundador
AI-powered browser extensions can read sessions, prompts, cookies, SaaS data and corporate secrets. Learn the real risks, technical controls and detection patterns to protect your organisation.
By Adrián González · CEO y socio fundador
AI Agents like ChatGPT, Perplexity, Claude and Gemini discover websites through 11 emerging standards. What they are and how to audit your site against them.
By Adrián González · CEO y socio fundador
Before you leave…
Quick 15-minute assessment and we'll tell you what to prioritise first: Microsoft 365, pentesting, vulnerability management, SOC, DORA, NIS2, ENS or ISO 27001.
No spam. Reply within 24h.
