Actions have consequences. In cybersecurity, we often only see actions at the surface level: a suspicious IP, a new domain, or a single mention on a dark web forum. For threat hunters, the consequences of treating these actions as isolated incidents are significant. These signals are rarely "one-offs." They are the visible tips of coordinated campaigns built on months of planning, spanning multiple tactics, techniques, and procedures (TTPs). Today’s adversaries are organized.

So your team just uncovered a GDPR tracking violation, a consent anomaly that, after a deeper look, turns out to be a pixel firing regardless of consent state.” From the looks of it, it’s definitely an ePrivacy violation. But the harder question, the one you now have to race against time to answer, is whether this is also a notifiable breach under GDPR. For that determination, you now have 72 hours. One gets fixed with a tag manager update and a stern email to marketing.

OAuth is a commonly used authorisation framework, that allows websites and web applications to request limited access to a user’s account on another application. Users can grant this limited access to their account, without ever needing to expose their password with the requesting website or application. This is commonly seen with sites that allow you to log in with popular accounts such as a social media login, Microsoft or Google account.

Update (February 24, 2026): @vmfunc has published part two of their series about Persona. You can read it here. We will update this post with part three when it is released. On February 16, 2026, security researchers @vmfunc, @MDLcsgo, and @DziurwaF published a blog post identifying exposed frontend source maps on a non-production subdomain under withpersona-gov.com.

You can’t fix what you ignore. For years, organizations have raced to deploy software faster, often leaving a trail of unresolved vulnerabilities in their wake. We call this trail security debt, or flaws that are left unresolved over a year since being discovered, and it isn’t just a technical metric. It’s a compounding business risk that is growing harder to manage every year. Today, we are releasing the 2026 State of Software Security (SoSS) report.

As cyber defenses become stronger, adversaries continue to evolve their tactics to succeed. In 2025, the year of the evasive adversary, the threat landscape was defined by attacks that targeted trusted relationships, demonstrated fluency with AI tools, and incorporated tradecraft tailored to exploit security blind spots.

For the past two years, the adoption of Generative AI has felt like a gold rush. Organizations raced to integrate Large Language Models and build autonomous agents to assist employees. They often bypassed standard governance processes in the name of speed and innovation. That era of unrestricted experimentation is rapidly drawing to a close. A massive regulatory wave is forming worldwide. Frameworks like the EU AI Act and the new ISO/IEC 42001 standard are forcing a corporate reckoning.

Financial services organizations moving to AWS often discover that retrofitting security and compliance controls costs three to five times more than building them in from the start. Compliance gaps discovered during audits can delay critical initiatives, trigger regulatory scrutiny, and expose organizations to unnecessary risk.

Threat actors are using phony meeting invites for Zoom, Microsoft Teams, Google Meet, and other video conferencing applications to trick users into installing remote monitoring and management (RMM) tools, according to researchers at Netskope. The invites lead to convincingly spoofed landing pages for fake video meetings, complete with a list of coworkers who have supposedly already joined the call. The page instructs the user to install a software update in order to join the video meeting.