Most incident response plans fail not because they’re badly written, but because nobody rehearsed them. Here’s what actually makes one survive a real breach.
-
-
CISA published the exact attack chain its red team used against two infrastructure operators, and only one SOC caught it. Here’s how to turn that into a test plan.
-
A regulator review found most law firms skip penetration testing entirely. Here is what the SRA’s data actually shows, what a proper scope should cover, and how often to test.
-
A PaperCut vulnerability chain let attackers bypass login and run code on print servers, and the vendor needed a second emergency patch after the first one was bypassed.
-
Two quotes, two different labels: one for “ethical hacking”, one for a “penetration test”. Here’s how to tell what you’re actually buying before you sign.
-
The honest answer on whether penetration testing for small business is worth it, when it’s genuinely necessary, and when you can reasonably wait.
-
The NCSC has warned about internet-exposed edge devices three times since April. The failures are basic. The problem is nobody owns fixing them.
-
CVE-2026-21962 scores a perfect 10 on the CVSS scale and has been under active, automated attack since January. Here’s what it does and how to check if you’re exposed.
-
Ransomware isn’t getting more sophisticated, it’s getting more industrialised. Here’s how the criminal supply chain behind it works, and why the same basic gaps keep letting it in.
-
A practical guide to running a business impact assessment: NIST’s three-step process, setting real recovery targets, and turning the results into action.