Insights & Analysis

The Cyber Craft Blog

Perspectives on AI security, trust verification, and defending the new attack surfaces that AI creates.

Introducing the CraftedTrust Agent Trust Stack: 5 Layers of AI Agent Security

How CraftedTrust connects registry search, certification, governance, identity, and attestations across the agent trust journey.

Read article →

State of MCP Server Security 2026

We scanned 4,274+ MCP servers and analyzed their security posture. Here's what we found: grade distributions, auth gaps, compliance failures, and the state of the ecosystem.

Read article →

Why AI Agents Should Pay for Trust Verification (and How x402 Makes It Possible)

x402 micropayments let AI agents pay per-request for trust verification and other premium CraftedTrust workflows using USDC on Base.

Read article →

On-Chain Trust: How EAS Attestations Make AI Agent Certifications Verifiable

CraftedTrust anchors certifications as EAS attestations on Base, making them independently verifiable and tying them back to registry and governance workflows.

Read article →

CraftedTrust Now Maps to 5 Major Compliance Frameworks

CraftedTrust maps trust and certification data to major compliance frameworks, giving enterprises auditable signals for agent governance and review.

Read article →

Our NIST Comment on AI Agent Identity and Authorization

We filed a formal comment with the NIST NCCoE on AI agent identity and authorization. Here's what we said and why it matters for the MCP ecosystem.

Read article →

CraftedTrust Touchstone: Building a CVE Research Engine for the MCP Ecosystem

Touchstone is CraftedTrust's security research authority for MCP servers, spanning scans, advisories, disclosures, and certification support.

Read article →

75% of CISOs Are Securing AI with Yesterday's Tools

Pentera's 2026 benchmark report reveals most organizations rely on legacy security controls for AI. Here is what needs to change, backed by data from 300 US CISOs.

Read article →

AI Agents as Attack Surface: What MCP, Tool Use, and Agent Chains Mean for Security

AI agents can browse, execute code, and make API calls. Each capability is an attack surface. Mapping the threats from prompt injection to supply chain risk.

Read article →

How to Run a Tabletop Security Exercise in 60 Minutes

A complete tabletop exercise kit with facilitator guide, three ready-to-use scenarios, discussion prompts, and scoring rubric. No external facilitator needed.

Read article →

Network Segmentation on a Budget: How to Isolate Your Most Sensitive Systems

How to implement VLANs and firewall rules on equipment you already own. Separate guest WiFi, IoT, servers, and workstations into isolated segments.

Read article →

Secure Coding Practices Every Developer Should Know (With Real Vulnerabilities)

OWASP Top 10 with real code examples in Python and JavaScript. Vulnerable code vs. fixed code, plus Semgrep scanning and pre-commit hooks.

Read article →

IoT Security for Small Offices: Printers, Cameras, and the Devices No One Patches

Every office has IoT devices nobody thinks about. How to find them with Nmap, segment them onto a VLAN, and set up firmware update schedules.

Read article →

OAuth Misconfigurations That Let Attackers Into Your App

The 7 most exploited OAuth/OIDC misconfigurations with code examples showing the vulnerability and the fix. Open redirects, PKCE, token storage, and more.

Read article →

Deepfakes in the Boardroom: How Real-Time AI Impersonation Actually Works

Live deepfakes are being used in Zoom calls to authorize wire transfers. The technology, the detection artifacts, and a practical verification protocol.

Read article →

Data Classification: The Security Step Everyone Skips

You can't protect data you haven't classified. A 4-tier system, inventory process, and handling rules for every classification level.

Read article →

The Board Wants a Cybersecurity Report. Here's What to Actually Put in It.

5 metrics that matter, how to translate technical findings to financial risk language, and what to say when the board asks "are we secure?"

Read article →

Container Security: How to Stop Your Docker Images from Leaking Secrets

Top 10 container security mistakes and how to fix each one. Dockerfile templates, Trivy scanning, and Kubernetes NetworkPolicy examples.

Read article →

Third-Party Vendor Risk Assessment: A Practical Guide for Small Teams

A vendor risk workflow for teams without a GRC department. Scoring vendors, security questionnaires, and contract clauses that protect you.

Read article →

Agentic AI Is Breaking IAM - How to Authenticate Non-Human Identities

AI agents make API calls and access databases, but IAM was built for humans. OAuth2 client credentials, short-lived tokens, and agent permission matrices.

Read article →

How Malicious Extensions Steal Your AI Conversations - A Technical Breakdown

Deep technical analysis of fetch overrides, DOM scraping, data staging, and C2 exfiltration. How 6-factor risk scoring catches each pattern.

Read article →

What Your Security Score Actually Means (And How to Fix It)

A plain-English breakdown of the seven checks in a website security scan. Learn what SSL, SPF, DMARC, DKIM, and security headers do and how to fix common gaps.

Read article →

Chrome Extension Security: What Every User Should Know

How Chrome extensions access your data, real-world incidents from the 2025-2026 AI chat harvesting wave, and how multi-factor risk scoring catches malicious patterns.

Read article →

Penetration Testing: What It Is, Why You Need It, and How to Prepare

A practical guide to penetration testing for businesses. Learn what to expect, how to scope an engagement, and how to get the most value from your pentest.

Read article →

Enterprise AI Security Checklist: 10 Controls You Need Before Deploying AI

A practical checklist for securing AI deployments in enterprise environments. Covers data protection, model security, access controls, and compliance.

Read article →

Why Your AI Conversations Aren't as Private as You Think

9M+ users had AI chats harvested by malicious extensions in 90 days. How content script interception works, why AI conversations are high-value targets, and what to do about it.

Read article →

How We Score MCP Servers: A 12-Factor Trust Framework

MCP connects AI agents to external tools - but who verifies the servers? We built a 12-factor CoSAI-aligned scoring system across 4,274+ servers to bring transparency to the protocol.

Read article →

Running Your First Security Assessment: NIST, ISO 27001 & Beyond

You don't need a six-figure consulting engagement to understand your security posture. Here's how to get started with the major frameworks - for free.

Read article →

The Permission Problem: Why Browser Extensions Are a Blind Spot

Most users install extensions without reading permissions. What "read and change all your data on all websites" actually means, and why your AI chats are the most valuable target.

Read article →

SBOM: Why Every Piece of Software Will Need an Ingredient Label

SBOMs are becoming mandatory for government vendors. What they are, SPDX vs CycloneDX, and how to generate and scan one with free tools.

Read article →

Supply Chain Attacks: From SolarWinds to Your npm install

The software supply chain is the most underdefended attack surface in modern computing. Here is how attackers exploit it and what you can do today.

Read article →

The Identity Crisis: Why Credential Theft Is Now the #1 Attack Vector

82% of attacks are now malware-free, relying on stolen credentials and identity abuse. How credentials reach the dark web and how to harden your identity posture.

Read article →

AI Governance in 2026: What Every Business Needs to Know

The EU AI Act is live, the SEC wants AI disclosures, and your customers want transparency. A practical guide to AI governance without the legalese.

Read article →

Holiday Scam Season: The Technical Anatomy of a Modern Phishing Kit

How phishing kits actually work: typosquatting, Let's Encrypt trust, HTML cloning, reverse proxy credential harvesting, and Telegram bot exfiltration.

Read article →

2025 in Cybersecurity: The Year AI Changed Everything

From the biggest breaches to the most important policy shifts, here is what defined cybersecurity in 2025 and what it means for 2026.

Read article →

Shadow AI: Your Employees Are Using AI Tools You Don't Know About

Employees are pasting proprietary data into AI tools without IT's knowledge. How to discover unauthorized AI usage and build an acceptable use policy.

Read article →

DNS Security: The Most Overlooked Layer of Defense

DNS is the backbone of the internet, and it is almost never secured. Here is why DNS attacks are so effective and what protective DNS can do for you.

Read article →

Cyber Insurance in 2025: What's Covered, What's Not, and How to Get a Better Rate

What your policy actually covers, what's excluded, the 12 controls insurers require, and how better security can reduce your premium 15-30%.

Read article →

Building a Security Culture That Doesn't Suck

Security awareness training is universally hated. Here is how to build a security culture that employees actually engage with instead of resent.

Read article →

Threat Modeling for People Who Hate Threat Modeling

STRIDE made accessible. Walk through a real SaaS login flow, compare frameworks, and get a 1-hour workshop format any team can run.

Read article →

Prompt Injection: The New SQL Injection

SQL injection dominated the 2000s. Prompt injection is the equivalent for the AI era. Here is how it works, why it is hard to fix, and what defenders need to know.

Read article →

Ransomware Defense Playbook: What to Do Before, During, and After an Attack

A complete operational playbook covering prevention, active incident response, and recovery. Includes the 3-2-1-1 backup rule and a pay/don't pay framework.

Read article →

The Hidden Cost of Free Software: What You're Really Paying

If you are not paying for the product, you ARE the product. Here is how free tools monetize your data and what to look for before you install.

Read article →

MFA Isn't Bulletproof - How Attackers Bypass Two-Factor Authentication

The 5 main MFA bypass techniques in active use: SIM swapping, AitM proxies, push bombing, SS7 interception, and session theft. Which methods are actually phishing-resistant.

Read article →

API Security in the Age of AI Agents

AI agents are making thousands of API calls per minute. Most APIs were not built for this. Here is what breaks and how to fix it.

Read article →

How to Build an Incident Response Plan When You Don't Have a Security Team

A complete IR plan template for organizations with no dedicated security staff. Detection, containment, recovery, customer notification, and when to call law enforcement.

Read article →

Why Small Businesses Are the #1 Target for Cyberattacks

43% of cyberattacks target small businesses. Most don't have dedicated security staff. Here is why attackers prefer small targets and what you can do.

Read article →

Cloud Misconfiguration Is the #1 Cause of Data Breaches - How to Audit Yours

The most common cloud misconfigurations, CLI commands to find public-facing storage, a 10-item audit checklist, and a 30-minute monthly routine.

Read article →

Zero Trust Architecture: Beyond the Buzzword

Everyone talks about Zero Trust. Few understand it. Here is what it actually means, why it matters for small businesses, and how to start implementing it.

Read article →

Passkeys Are Replacing Passwords - Here's What You Need to Know

How passkeys work, why they eliminate phishing by design, and step-by-step setup for Google, Apple, and Microsoft accounts.

Read article →

The Rise of AI-Powered Social Engineering

Deepfakes, voice cloning, and GPT-generated phishing - AI is supercharging social engineering attacks. Here is what changed and how to adapt.

Read article →