Post-quantum readiness starts with knowing your certificates
The latest certificate research points to a practical first step: know what depends on your existing trust systems before changing them.
Read article →Security news.
A clearer next step.
Recent research, useful context, and practical ways to improve security, AI workflows, and everyday systems.
Recent news is organized by its reporting date. Each article identifies its sources and when the analysis was added or updated.
In focus · July 21, 2026What the OpenAI agent sandbox breach means for businesses65 articles
AI can find more bugs. Your fix process still has to work.
Recent research shows progress in automated vulnerability discovery. The useful question for a business is how findings become verified fixes.
Read article →A real remote-support installer can still be the wrong one
A recent phishing campaign used legitimate remote-management software. Verify the request and the access being granted, as well as the file.
Read article →AI-assisted attacks are shortening the response window
Google's September threat report described attackers moving from prompts to agent workflows. Clear ownership and fast containment matter when activity accelerates.
Read article →The PaperCut zero-days showed why office systems need an owner
Active attacks on PaperCut NG and MF brought print-management servers into the security response. Include office systems in exposure, update, and recovery plans.
Read article →The Cypress incident put secrets in test data back on the agenda
A third-party analytics incident affected Cypress data and some embedded credentials. Review what your development tools record, retain, and share.
Read article →OpenAI's agent sandbox breach: what businesses should take from it
The OpenAI and Hugging Face incident showed how an evaluation agent could cross real security boundaries. The business lesson is to test the controls around every tool and credential.
Read article →The SharePoint attacks made patching and recovery one conversation
CISA warned about active attacks on on-premises SharePoint. A patch closes a vulnerability; investigation establishes what happened before it arrived.
Read article →The 2026 DBIR lesson: patch paths matter more than dashboards
Verizon's 2026 DBIR points to vulnerability exploitation, ransomware, mobile threats, and AI-augmented attacks. The practical response is a disciplined patch path.
Read article →Agentic workflows make CI/CD the new blast radius
GitHub's June 2026 agentic workflow and Actions security updates show why AI coding agents need CI/CD permissions, triggers, caches, and secrets reviewed as one security boundary.
Read article →The MCP security crisis is really a third-party access problem
CSA's May 2026 MCP research is a reminder that MCP servers should be governed like connected vendors: inventory, permissions, monitoring, and revocation.
Read article →CISA's agentic AI guide turns adoption into control work
CISA's May 2026 agentic AI guidance gives teams a practical control checklist: low-risk starts, limited privilege, usable logs, human fallback, and stronger oversight.
Read article →AIUC-1 Q2 2026 shows where agent governance is heading
AIUC-1's Apr. 15, 2026 update shows the market shift from AI policy binders to approved tools, verified identities, logged actions, and monitored third parties.
Read article →Agentic AI Is Breaking IAM - How to Authenticate Non-Human Identities
AI agents are making API calls, accessing databases, and acting on behalf of users, but IAM was designed for humans. Here is how to authenticate agents, scope permissions, and audit every action.
Read article →Third-Party Vendor Risk Assessment: A Practical Guide for Small Teams
A practical vendor risk assessment workflow for small teams without a GRC department. Learn how to score vendors, ask the right security questions, and add protective clauses to your contracts.
Read article →AI Agents as Attack Surface: What MCP, Tool Use, and Agent Chains Mean for Security
AI agents using MCP, function calling, and tool chains introduce new attack surfaces. Learn the specific threats and how to defend against them.
Read article →How to Run a Tabletop Security Exercise in 60 Minutes
A complete 60-minute tabletop exercise kit with facilitator guide, three ready-to-use scenarios, discussion prompts, scoring rubric, and post-exercise report template. No external facilitator needed.
Read article →Network Segmentation for Small Business: IoT and Guest Wi-Fi
Separate IoT devices, guest Wi-Fi, and staff computers with a practical VLAN plan, firewall rules, and a small-office network example.
Read article →Secure Coding Practices Every Developer Should Know (With Real Vulnerabilities)
Walk through the OWASP Top 10 with real vulnerable vs fixed code examples in Python and JavaScript. Includes Semgrep scanning, pre-commit hooks, and a 10-point secure coding checklist for code reviews.
Read article →IoT Security for Small Offices: Printers, Cameras, and the Devices No One Patches
Your office is full of IoT devices nobody thinks about. Printers, cameras, smart TVs, and VoIP phones are common attack targets. Here's how to find and secure them.
Read article →OAuth Misconfigurations That Let Attackers Into Your App
The 7 most exploited OAuth and OIDC misconfigurations, from open redirect callbacks to missing PKCE. Includes code examples showing each vulnerability and the fix.
Read article →Introducing the CraftedTrust Agent Trust Stack: 5 Layers of AI Agent Security
Research archive describing an earlier five-layer CraftedTrust architecture. The active product is now the focused public MCP registry.
Read article →CraftedTrust Now Maps to 5 Major Compliance Frameworks
Research archive mapping MCP trust signals to CoSAI, OWASP, EU AI Act, NIST AI RMF, and AIUC-1. The current registry does not issue compliance assessments.
Read article →Deepfakes in the Boardroom: How Real-Time AI Impersonation Actually Works
Real-time deepfakes are being used in Zoom calls to impersonate executives and authorize wire transfers. Learn how the technology works, how to detect artifacts, and how to build a verification protocol that stops deepfake fraud.
Read article →On-Chain Trust: How EAS Attestations Make AI Agent Certifications Verifiable
Research archive exploring EAS attestations for machine-verifiable AI agent certification. This is not part of the current CraftedTrust registry offering.
Read article →Our NIST Comment on AI Agent Identity and Authorization
We filed a formal comment with the NIST NCCoE on AI agent identity and authorization. Here's what we said and why it matters for the MCP ecosystem.
Read article →State of MCP Server Security 2026
March 2026 research snapshot of MCP server security, including grade distributions, authentication gaps, and common failures. Current coverage appears in the live registry.
Read article →CraftedTrust Touchstone: Building a CVE Research Engine for the MCP Ecosystem
Research archive describing an earlier Touchstone CVE research concept. The active CraftedTrust product is now the public MCP registry.
Read article →Why AI Agents Should Pay for Trust Verification (and How x402 Makes It Possible)
Research archive exploring x402 micropayments for agent-native trust verification. Payment-gated verification is not part of the current CraftedTrust registry.
Read article →Data Classification: The Security Step Everyone Skips
You can't protect data you haven't classified. Learn a practical 4-tier classification system, how to inventory data assets, and how to map each tier to specific handling rules.
Read article →75% of CISOs Are Securing AI with Yesterday's Tools. Here's What Needs to Change.
Pentera's 2026 benchmark report reveals most organizations rely on legacy security controls for AI. Here is what needs to change, backed by data from 300 US CISOs.
Read article →The Board Wants a Cybersecurity Report. Here's What to Actually Put in It.
Boards don't care about CVE counts. They care about business risk. Learn the 5 metrics that matter, how to translate technical findings into financial risk language, and what to say when the board asks if you're secure.
Read article →Container Security: How to Stop Your Docker Images from Leaking Secrets
The top 10 container security mistakes teams make with Docker and Kubernetes, from secrets in images to running as root. Practical fixes with Dockerfile templates, Trivy scanning, and NetworkPolicy examples.
Read article →How Malicious Extensions Steal Your AI Conversations - A Technical Breakdown
Deep technical analysis of how malicious Chrome extensions intercept AI chat data, covering fetch overrides, DOM scraping, data staging, and C2 exfiltration techniques used in real-world campaigns.
Read article →What Your Security Score Actually Means (And How to Fix It)
A plain-English breakdown of the seven checks in a website security scan. Learn what SSL, SPF, DMARC, DKIM, and security headers do and how to fix common gaps.
Read article →Chrome Extension Security: What Every User Should Know
How Chrome extensions access your data, the risks they pose, and practical steps to protect yourself from malicious browser extensions.
Read article →Why Your AI Conversations Aren't as Private as You Think
Real incidents prove browser extensions are harvesting AI conversations at scale. Learn how content script interception works, why AI chats are high-value targets, and how to protect yourself.
Read article →Penetration Testing: What It Is, Why You Need It, and How to Prepare
A practical guide to penetration testing for businesses. Learn what to expect, how to scope an engagement, and how to get the most value from your pentest.
Read article →How We Score MCP Servers: A 12-Factor Trust Framework
How the CraftedTrust public registry separates 12 categories of MCP trust evidence, scan depth, confidence, and age before connection.
Read article →Enterprise AI Security Checklist: 10 Controls You Need Before Deploying AI
A practical checklist for securing AI deployments in enterprise environments. Covers data protection, model security, access controls, and compliance.
Read article →Running Your First Security Assessment: NIST, ISO 27001 & Beyond
How to evaluate your security posture against NIST, ISO 27001, CIS Controls, SOC 2, and PCI-DSS - for free.
Read article →The Permission Problem: Why Browser Extensions Are a Blind Spot
Most users install browser extensions without reading permissions. Here's why that matters and what 'read and change all your data' actually means.
Read article →SBOM: Why Every Piece of Software Will Need an Ingredient Label
SBOMs are becoming mandatory for software transparency. Learn what a Software Bill of Materials is, how to generate one with Syft, scan it with Grype, and why federal mandates make this urgent in 2026.
Read article →Supply Chain Attacks: From SolarWinds to Your npm install
The software supply chain is the most underdefended attack surface in modern computing. Here is how attackers exploit it and what you can do today.
Read article →The Identity Crisis: Why Credential Theft Is Now the #1 Attack Vector
CrowdStrike found 79% of 2024 intrusions were malware-free, using stolen credentials and session tokens instead. Learn why identity replaced malware as the primary attack vector and how to protect your organization.
Read article →AI Governance in 2026: What Every Business Needs to Know
The EU AI Act is live, the SEC wants AI disclosures, and your customers want transparency. A practical guide to AI governance for businesses of every size.
Read article →2025 in Cybersecurity: The Year AI Changed Everything
From the biggest breaches to the most important policy shifts, here is what defined cybersecurity in 2025 and what it means for 2026.
Read article →Holiday Scam Season: The Technical Anatomy of a Modern Phishing Kit
A technical deep-dive into how modern phishing kits work: domain typosquatting, HTTPS certificate abuse, HTML cloning, credential harvesting via reverse proxy, session token replay, and Telegram-based exfiltration. Five checks to spot a phishing site in under 10 seconds.
Read article →DNS Security: The Most Overlooked Layer of Defense
DNS is the backbone of the internet, and it's almost never secured. Here's why DNS attacks are so effective and what protective DNS can do for you.
Read article →Shadow AI: Your Employees Are Using AI Tools You Don't Know About
Employees are pasting proprietary code, customer data, and strategy docs into unauthorized AI tools. Learn how to discover shadow AI usage, build an approved tool list, and write an AI acceptable use policy that works.
Read article →Building a Security Culture That Doesn't Suck
Security awareness training is universally hated. Here's how to build a security culture that employees actually engage with instead of resent.
Read article →Cyber Insurance in 2025: What's Covered, What's Not, and How to Get a Better Rate
A practical guide to cyber insurance for small businesses in 2025. Learn what's covered, what's excluded, the security controls insurers require, and how to reduce your premium by 15-30%.
Read article →Threat Modeling for People Who Hate Threat Modeling
STRIDE doesn't have to be painful. Walk through a real SaaS login flow example, compare frameworks, and get a ready-to-run 1-hour workshop format your team can use today.
Read article →Prompt Injection: The New SQL Injection
SQL injection dominated the 2000s. Prompt injection is the equivalent for the AI era. Here's how it works, why it's hard to fix, and what defenders need to know.
Read article →Ransomware Defense Playbook: What to Do Before, During, and After an Attack
A complete operational playbook for ransomware defense covering prevention, active incident response, and recovery. Includes the 3-2-1-1 backup rule, pay-or-don't-pay framework, and post-incident hardening.
Read article →The Hidden Cost of Free Software: What You're Really Paying
If you're not paying for the product, you ARE the product. Here's how free tools monetize your data and what to look for before you install.
Read article →API Security in the Age of AI Agents
AI agents are making thousands of API calls per minute. Most APIs weren't built for this. Here's what breaks and how to fix it.
Read article →MFA Isn't Bulletproof. Here's How Attackers Bypass Two-Factor Authentication.
Five MFA bypass techniques actively used by attackers: SIM swapping, AitM phishing proxies, MFA fatigue, SS7 interception, and session token theft. Learn which MFA methods are phishing-resistant and how to protect your accounts.
Read article →How to Build an Incident Response Plan When You Don't Have a Security Team
A complete, practical incident response plan template for small businesses without dedicated security staff. Covers detection, containment, eradication, recovery, and post-incident review.
Read article →Why Small Businesses Are the #1 Target for Cyberattacks
43% of cyberattacks target small businesses. Most don't have dedicated security staff. Here's why attackers prefer small targets and what you can do about it.
Read article →Zero Trust Architecture: Beyond the Buzzword
Everyone talks about Zero Trust. Few understand it. Here's what it actually means, why it matters for small businesses, and how to start implementing it today.
Read article →Cloud Misconfiguration Is the #1 Cause of Data Breaches - How to Audit Yours
Cloud misconfigurations like public S3 buckets and overly permissive IAM roles cause more breaches than any other vector. Learn how to audit your cloud environment with a practical 10-item checklist.
Read article →Passkeys Are Replacing Passwords - Here's What You Need to Know
Passkeys explained: how public-private key pairs eliminate phishing by design, how to enable them on Google, Apple, and Microsoft, and what businesses need to know about WebAuthn in 2025.
Read article →The Rise of AI-Powered Social Engineering
Deepfakes, voice cloning, and GPT-generated phishing - AI is supercharging social engineering attacks. Here's what changed and how to adapt.
Read article →Baseline review, operations security review, or pen test?
A practical guide to choosing between a Security Baseline Review, an Operations Security Review, and a penetration test.
Read article →No articles match that search. Try a different topic or clear the search.