Articles 121 to 144 of 152. To search by keyword, go back to the blog hub.
Scanning for vulnerabilities is not managing risk. How to prioritise, remediate and evidence vulnerabilities in ENS, NIS2, ISO 27001 and enterprise environments.
By Adrián González · CEO y socio fundador
Many organisations use "audit" and "pentest" interchangeably, but they are not the same. What each one reviews, when to buy which, and how to choose.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
What penetration testing is, the types that exist, how a test is run, the methodology behind it and when it genuinely makes sense for an organisation.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
What a Security Operations Centre really is, the service levels it should offer and how it maps to NIS2, DORA and ENS: monitoring, managed security and forensic investigation.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Vulnerability management is not just running a scanner. It includes inventory, detection, risk-based prioritisation, remediation, verification, exceptions, reporting and continuous follow-up.
By Adrián González · CEO y socio fundador
Healthcare is Europe's most ransomware-hit sector and an essential entity under NIS2. What ENISA's data shows, what the law demands and how to protect a hospital group without disrupting care.
By Adrián González · CEO y socio fundador
CVE-2026-12569 gives unauthenticated remote code execution on PTC Windchill and FlexPLM, already exploited with JSP web shells. Why your PLM is an attack surface almost no one inventories.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
A CVSS 10.0 flaw in SimpleHelp lets attackers forge OIDC tokens and gain technician sessions without credentials. Now on CISA's KEV list, exploited to deploy TaskWeaver and Djinn Stealer.
By Adrián González · CEO y socio fundador
CISA added CVE-2026-45659 to KEV on 1 July: a SharePoint on-premises RCE that Storm-2603 abuses to deploy Warlock ransomware. What to detect and how to respond.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Sysdig documents JADEPUFFER, the first agentic ransomware: an AI model that entered through Langflow, stole credentials and destroyed a database. Read from the defender's side.
By Adrián González · CEO y socio fundador
Two critical Cursor flaws (DuneSlide) turn indirect prompt injection into code execution. What it means for the AI editors your developers use, and how to defend.
By Adrián González · CEO y socio fundador
The US is offering up to $10 million for information on Russian-linked groups that compromised Signal and WhatsApp accounts. What companies and executives should do next.
By Adrián González · CEO y socio fundador
On 23 June 2026 CISA added four UniFi OS and Lantronix EDS5000 flaws to its KEV catalogue. Chained, three of them give unauthenticated remote code execution on the box that manages your network.
By Adrián González · CEO y socio fundador
An unauthenticated endpoint in Splunk Enterprise's PostgreSQL service allows remote code execution. CISA added it to the KEV catalogue on 18 June. What breaks and how to contain it.
By Adrián González · CEO y socio fundador
DragonForce hid its command and control inside Microsoft Teams TURN relays and stayed undetected for nearly two months. How Backdoor.Turn works and how to hunt it on your network.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
On 17 June 2026 an attacker pushed more than 140 @mastra npm packages carrying a malicious dependency that runs a trojan during postinstall. What happened, and how to defend against it.
By Irene Ocando · Directora de Cumplimiento Normativo Hard2bit
We ran a 100% passive OSINT scan against 24 well-known brands and found 591 live typosquatting domains. 48% can send email. Anonymised aggregate data, June 2026.
By Adrián González · CEO y socio fundador
ClickFix tricks users into running PowerShell by pasting a command. 517% growth in 2025. Anatomy, operational detection and defences that genuinely work.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
Realistic 2026 ranges for cybersecurity audit pricing in the Spanish and EU mid-market, what a professional audit covers and how to choose a serious provider.
By Irene Ocando · Directora de Cumplimiento Normativo Hard2bit
ENISA Threat Landscape 2025 (4,875 EU incidents) and Verizon DBIR 2026 combined: five CISO lessons on supply chain, digital dependencies, vulnerabilities, AI phishing and NIS2.
By Adrián González · CEO y socio fundador
A practical 12-KPI cyber resilience dashboard for the Board: what to measure, how to present it, and how to use it to drive decisions on risk, investment and strategy.
By Adrián González · CEO y socio fundador
SPIFFE/SPIRE for workload identity and OAuth for machine-to-machine: how each works, where each fits, and the hybrid pattern that scales for cloud-native enterprises.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
How to combine CISA KEV, EPSS and SSVC to prioritise exploitable vulnerabilities, replace CVSS-only triage and produce defensible remediation decisions.
By Thilina Manana · COO, Director Técnico de Seguridad hard2bit y socio fundador
How to implement Continuous Threat Exposure Management (CTEM) in regulated enterprises: five phases, architecture, KPIs, compliance mapping and a 90-day rollout plan.
By Adrián González · CEO y socio fundador
Before you leave…
Quick 15-minute assessment and we'll tell you what to prioritise first: Microsoft 365, pentesting, vulnerability management, SOC, DORA, NIS2, ENS or ISO 27001.
No spam. Reply within 24h.
