Security for the systems your business runs on, in plain terms.
Field notes, threat breakdowns and practical guidance from the MBCTG team.
Your CRA Reporting Clock Starts at Awareness. Nobody Owns That Moment.
The CRA's 24 hour reporting duty went live on 11 September along with ENISA's platform. What the clock measures, who starts it, where filings go.
Your Remote Site Router Checked Half the SSH Key. Attackers Took Admin.
MikroTrick chains two RouterOS flaws into unauthenticated admin. Shadowserver counted 122,500 devices with SSH exposed. What to check this week.
Your Industrial VPN Client Takes Configuration From Anyone. It Runs as Root.
CVE-2026-75925 scores 9.6. IXON's industrial VPN client wrote unauthenticated config to a file a root process then executed. What to check now.
Your AI Coding Agent Already Ran Code. You Never Approved It.
A routine background git call let seven AI coding agents run attacker code without an approval prompt. Weeks later, four of the flaws are still open.
361 Victim IPs, 47 Countries, Five Days: Inside the CVE-2026-59310 Campaign
A critical vCenter flaw was exploited five days after its patch and reached 361 victim IP addresses in 47 countries. What it did and what to check now.
AI-Generated Scripts Are Attacking Siemens S7 PLCs: Inside Advisory AA26-231A
Five US agencies warn attackers are using AI-generated scripts to hit internet-exposed Siemens S7 PLCs. What AA26-231A found, and what to do now.
Manufacturing Absorbed 65% of Industrial Ransomware in Q2 2026 — Attackers Never Touched OT
Dragos logged 1,140 industrial ransomware incidents in Q2 2026, manufacturing hit hardest. Most never touched OT, because IT disruption alone was enough.
OWASP's 2026 LLM Top 10: Why Excessive Agency Jumped to #3
OWASP's 2026 LLM Top 10 ranked risk using real incident data for the first time. Excessive Agency jumped from 6th to 3rd, and here is why that matters.
The Math Doesn't Work: Four People Can't Watch 300 Employees Around the Clock
A 300-person company with a four-person IT team is not understaffed by accident. It is understaffed by design. Here is where the coverage actually breaks.
