Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Ransomware recovery for healthcare IT depends on isolated recovery environments (IRE) and the ability to find clean data for patient safety. Jeremy Cathey shares insights on building cyber resilience by moving away from traditional disaster recovery toward a model that handles systemic cyberattacks. He details the three essential zones of an IRE: the clean room for forensics, the staging zone for validation, and the standby production environment where clinicians resume work.

Ransomware doesn't just steal your data, it holds it hostage. Here's how an attack moves from entry to extortion, step by step. Watch part 2 of 5 where we break down how cyberattacks actually happen.

Standard incident response is failing to keep pace with long-term threat campaigns. Adam Karcher from the FBI explains why the most effective security teams run their operations as an inverted offensive strategy, leveraging continuous adversary emulation to stop intrusions before they begin. Watch the full video on our channel.

MSP Unscripted Episode 1, featuring Alvaro Gonzalez (Assured Data Protection), discusses how MSPs can build repeatable, scalable cyber resilience services through productization, clean recovery, and operational best practices.

True infrastructure protection requires balancing public configuration diversity with active vulnerabilities found in the CISA KEV catalog. Watch the full video on our channel.

Ransomware is evolving well beyond locking systems, and agentic AI is introducing a category of security risk most organizations are not yet equipped to handle. On The Cybersecurity Defenders Podcast, Behnaz Karimi, Senior Cybersecurity Analyst at Accenture and independent ransomware researcher, walks through what that shift actually looks like. The full conversation includes.

Investigators have turned the tables on one of the world’s most elusive regimes. After a security firm hired a man calling himself "Joseph," a team of private investigators did what no one had done before: they infiltrated a North Korean remote worker cell from the inside. Head to our YouTube channel and watch the full episode of To Catch a Thief, Season 2.

Everyone remembers WannaCry. WantToCry sounds like the same thing. It isn't. It encrypts your files remotely over SMB using nothing but stolen credentials and right now 1.5 million devices are sitting exposed on the public internet. In this episode we break down how remote ransomware works, why your antivirus and EDR never see it coming and what caught it in our Sophos telemetry.

Today we're speaking with Behnaz Karimi, an independent researcher specializing in ransomware and agentic AI systems, Senior Cybersecurity Analyst at Accenture, and founder of Tremorina, about how ransomware is evolving to target AI systems, machine learning pipelines, and autonomous agents.

In the decade after Sony, North Korea learned something fundamental: Destructive cyberattacks make headlines. Financial cyberattacks make money. One year after Sony, North Korea pulled off one of the most audacious bank heists in history and reshaped cybercrime in the process. Today, the regime has expanded those same tactics into billion dollar cryptocurrency heists and sprawling money laundering schemes designed to evade sanctions and bankroll the state – and its nuclear weapons program.

A criminal crew with APT-grade patience is trojanizing the very tools defenders trust. Host Tova Dvorin sits down with Adrian Culley to break down FBI FLASH-20260702-01 (coordinated with CISA) on TeamPCP — the group compromising Trivy, KICS, LiteLLM, and the Telnyx SDK to sit inside CI/CD pipelines. Inside: the CanisterWorm and SANDCLOCK credential stealers, the self-replicating "Mini Shai-Hulud" worm across npm and PyPI, npm account takeovers via expired recovery domains, and five concrete defenses — starting with searching your GitHub org for "tpcp-docs" right now.