Insights
Guides for CTOs, engineering leads and founders: which assessment to buy, which test accounts to hand over, whether a CVSS score should move and what to agree with a responder before an incident. For what changed this month, read the cyber news digest.
11 articlesLast updated 9 November 2026
Each one includes a checklist, numbered steps and at least one table.
What enterprise security reviews ask, how SOC 2, ISO/IEC 27001 and PCI DSS treat penetration testing, and how to scope and time a test before a deal closes.
Written for: Founders, CTOs and security leads at B2B software companies answering enterprise security reviews
Report anatomy, CVSS 4.0 and business context, reproduction steps, remediation, retests and attestation letters, and briefing a board and engineers.
Written for: CTOs, engineering leads and founders receiving a first report
Open ports, default accounts, encryption, least privilege, audit logs, backups, end-of-life versions and managed cloud settings, in the order we audit them.
Written for: Engineering leads, DBAs and platform teams running PostgreSQL, MySQL, SQL Server, MongoDB or managed cloud databases
TLS and headers, a CSP that blocks something, CMS plugins, payment-page scripts under PCI DSS 4.0.1, DNS, email, backups and third-party scripts.
Written for: Marketing, web and engineering leads responsible for a company website, CMS or online shop
What scans, audits, penetration tests and red team exercises each find and miss, who should buy which and when, and how to combine them across a year.
Written for: Founders and engineering leads deciding which assessment to buy
Amendment 13 took effect on 14 August 2025. What it means for Israeli databases: PPA fines, DPOs, registration, security levels, testing and breach reporting.
Written for: CTOs, CISOs and privacy leads at companies running databases of personal data in Israel, including those that also sell into the EU
Hour-by-hour decisions for the first day of a ransomware incident: contain, preserve evidence, scope identity, check backups and start the legal clocks.
Written for: Incident leads, CTOs and IT managers who have to make the first day's decisions
What the 2025 npm and PyPI compromises teach small teams: lock installs, pin CI actions, retire long-lived tokens and review new dependencies before merge.
Written for: Engineering leads and founders running teams of five to fifty developers on JavaScript or Python
Scope, environments, test accounts, team briefings and day one: how to prepare so a first penetration test finds what matters, not missing headers.
Written for: CTOs and engineering leads commissioning a first external test
What an incident response retainer covers, what to ask a provider, what to agree in advance, and the readiness work that makes the first hour faster.
Written for: CTOs, heads of IT and security leads deciding whether to put incident response help on standby
Prompt injection, agent risks and data leaks through rendered output, mapped to the OWASP Top 10 for LLM Applications (2026 update), with fixes and a test plan.
Written for: Engineering leads and product security owners shipping chat assistants, retrieval search or AI agents
Publicly reported incidents, exploited vulnerabilities and rule changes, each backed by at least two sources and paired with what we check because of it.
The US Attorney's Office in Manhattan said on 5 November 2026 that an indictment had been unsealed charging three defendants with wire fraud, aggravated identity theft and money laundering over a scheme that allegedly used artificial intelligence to impersonate corporate executives and attorneys and took about $129 million, according to the Associated Press and The Next Web. According to court documents cited by AP, the group emailed staff, often in accounting departments, posing as CEOs who needed help with a confidential financial transaction, then arranged phone or video calls in which AI mimicked the executive's voice and sometimes image. Victims were directed to an impersonated attorney at a major law firm who gave wire instructions, and the funds were converted to cryptocurrency. The charges are allegations and the defendants are presumed innocent.
CISA, the FBI and the US Departments of Health and Human Services, Agriculture and Transportation warned on 5 November 2026 that attackers are targeting unpatched or internet-accessible electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage facilities. According to BleepingComputer, the warning followed October attacks that remotely defrosted refrigerators at an estimated 250 to 350 French supermarkets, a second wave affecting more than 115 stores across six European countries, and an incident at three facilities of France's blood service. The agencies urged operators to take controllers off the public internet, change default passwords and apply available updates.
Sekoia's Threat Detection & Research team reported on 4 November 2026 a watering-hole campaign, uncovered in mid-October, that used compromised or cloned websites in the US, Ukraine, the Czech Republic and Bulgaria to profile visitors and serve platform-specific n-day exploit chains to unpatched iPhones and Android devices without user interaction. Between 27 August and 3 September 2026 the attackers also tampered with the Plerdy analytics tracker, which Sekoia says is loaded by thousands of mostly Ukrainian websites. Sekoia assesses with moderate to high confidence that APT29 (Midnight Blizzard) ran the campaign, and says every flaw used had been fixed by the respective vendor before it began.
A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email. When an audit or a threat model should come first, we say so on the call.