build-lab 2.0 is out. The PowerShell script I published to build a lab AD domain controller from a Windows Server ISO now builds domain-joined member servers too. No GUI, no clicking Next, nothing outside what Microsoft and VMware ship. Version 1.0 built one DC. It was a nice st…
If you don't have the professional experience, build it yourself. For the past year I've been using Microsoft Entra ID to manage all objects within my (fictitious) healthcare startup, OSHA, including user accounts, group accounts, devices and applications. OSHA operates across m…
Clean sweep on today's Cyberr daily challenge: 3/3 in Identity and access at mid level. Think you'd beat me? https://cyberr.ai/daily/ea4f23f2-c5e0-4100-b63a-f6565505960f
A compromised developer account can become a production security incident. Developers routinely work with credentials that connect them to valuable systems: Git repositories. Cloud consoles. CI/CD pipelines. AI coding assistants. Package registries. Databases. Production APIs. I…
“We use passkeys, so phishing can't get us.” I wouldn't be so confident. Passkeys are a major improvement in authentication security. But attackers are adapting around the technology rather than simply attacking the cryptography. Microsoft has documented active campaigns where a…
We spent years securing human users. Now we're creating digital employees that need the same security controls. AI agents are moving beyond answering questions. They're increasingly being given the ability to: → Call APIs → Query databases → Execute code → Access cloud resources…
The cloud didn't eliminate the perimeter. It moved the perimeter into identity. This is one of the biggest shifts in modern cybersecurity. Your infrastructure may be protected by: Firewalls. WAFs. EDR. Network segmentation. DDoS protection. But if an attacker obtains a highly pr…
You can secure your company perfectly—and still be compromised through someone you trusted. That's the uncomfortable reality of modern supply-chain attacks. Your organization may have: MFA. EDR. Firewalls. SIEM. Strong passwords. Security policies. But what happens when a truste…
Imrane T. — Offensive Security | Attack Chains & Business Logic
One authenticated session. One changed member ID. One missing ownership check. While testing an API flow, I found that changing a client-controlled memberId allowed the session to resolve another account’s preference state. Same session. Different account object. HTTP 200. The r…
Schomer — Principal Security Solutions Architect & Founder
Chained Memory Exploits vs. Authentication Spoofing: Why the Application Plane is Failing Under Fire The simultaneous exploitation of BeyondTrust (CVE-2026-102764) and the PHP2Shell memory chain (CVE-2026-109618/19) exposes the complete collapse of application-level trust bounda…
Schomer — Principal Security Solutions Architect & Founder
Samuel Watua Soita dropped an excellent point recently about how AI is rewriting the economics of phishing. The takeaway is clear: We can no longer train users to spot fakes when the fakes are mathematically perfect copies. Traditional awareness training looks at the perimeter—b…
I'd like to experiment with 'paired' persona context engineering in my next position managing an objective or mission such as an InfoSec IAM modernization program. What this means is standing up a side-by-side team of AI personas to perform the same InfoSec program functions the…
HOTEL GUEST DATA: ACCESS CONTROL, VISIBILITY AND DATA LIFECYCLE A hotel may process guest information across its PMS, booking channels, payment providers, CRM, email systems and third-party platforms. The security boundary therefore extends beyond a single database. An authorize…
Identity is part of the attack surface. A compromised account is only dangerous because of what that account can access. So during an investigation, don't stop at: “Which account was compromised?” Ask: → What privileges did it have? → What systems could it reach? → What data cou…
One stolen password can become an entire security incident. The problem isn't always the password itself. It's what that identity can reach. A compromised account may provide access to: → Email and collaboration tools → Cloud consoles → Internal applications → Customer informati…
OAuth & MCP Investigation Checklist: 4 Steps to Assess Risk As organizations adopt OAuth-connected applications and Model Context Protocol (MCP) integrations, it's important to evaluate how these connections could expose sensitive data or increase attack surface. 1. Inventory Co…
Samantha Swift — Product, Go-to-Market & Marketing Leadership
ASOS has confirmed a data breach after customers received an unauthorised notification through its own app claiming attackers had compromised company data. The incident involves third-party platforms ASOS uses to communicate with customers. The retailer says names and contact de…
Schomer — Principal Security Solutions Architect & Founder
The system isn't just breaking—it’s completely blind. Look at the Cyberr threat feed over the last hour. Three massive stories just dropped that prove application-layer, identity-based security is entirely obsolete: 1️⃣ BAE Systems Hacked: A cyberattack on a defense giant has kn…
Why are people still trying to defend tomorrow's infrastructure with yesterday's thinking? We've spent decades building careers, architectures, security programs, and entire industries around assumptions that made sense when we controlled the network, owned the infrastructure, a…
When Machines Act for Us, Integrity Becomes the Security Question Picture a procurement agent asked to cut supplier costs by ten percent. It reads the contracts, finds a cheaper vendor, cancels three standing orders and signs a new agreement before lunch. No attacker was involve…
Schomer — Principal Security Solutions Architect & Founder
🔒 HACKERS DON'T BREAK IN; THEY LOG IN. WHY IDENTITY SECRETS ARE AN ARCHITECTURAL TRAP. The industry is learning a painful lesson: traditional IAM and network segmentation are completely helpless against an attacker holding valid, compromised credentials. When a rogue actor uses…