🚀 Excited to share my latest Governance, Risk, and Compliance (GRC) project completed on Cyberr, where I engineered an audit-ready, mini-Information Security Management System (ISMS) from the ground up. Simulating the role of a Cybersecurity Governance, Risk and Compliance Cons…
If you don't have the professional experience, build it yourself. For the past year I've been using Microsoft Entra ID to manage all objects within my (fictitious) healthcare startup, OSHA, including user accounts, group accounts, devices and applications. OSHA operates across m…
“Tomorrow, 1:00 PM ET: Watch an Attacker Log In Without a Password & Stay In After the Reset” is the kind of headline commonly used to promote a cybersecurity webinar or demonstration focused on identity attacks , particularly attacks that target authentication tokens, sessions,…
A compromised developer account can become a production security incident. Developers routinely work with credentials that connect them to valuable systems: Git repositories. Cloud consoles. CI/CD pipelines. AI coding assistants. Package registries. Databases. Production APIs. I…
A critical flaw threatens websites worldwide. Millions of California student records are exposed. An AI coding service suffers a security breach. This week's cybersecurity news reveals a common concern: even when we take precautions to protect our devices and accounts, the servi…
We spent years securing human users. Now we're creating digital employees that need the same security controls. AI agents are moving beyond answering questions. They're increasingly being given the ability to: → Call APIs → Query databases → Execute code → Access cloud resources…
You can secure your company perfectly—and still be compromised through someone you trusted. That's the uncomfortable reality of modern supply-chain attacks. Your organization may have: MFA. EDR. Firewalls. SIEM. Strong passwords. Security policies. But what happens when a truste…
What if the person asking you to “fix your computer” is actually trying to compromise the entire company? This isn't science fiction. Microsoft has reported attacks where threat actors impersonate IT support through Microsoft Teams, convincing targets to interact with them and u…
Let's assume a hardening chain of thought. Suppose that you got hired to harden a business that appeals to two distinct types of clients: public and private. Public clients' concerns include GDPR and PII protection, while private clients' concerns include legal disclosures, conf…
Your security logs may already contain the evidence of a breach—you just haven't connected the dots. That's one of the hardest problems in cybersecurity. An attacker doesn't always trigger a dramatic alert. Sometimes it's: A login at an unusual time. A new MFA device. A privileg…
Schomer — Principal Security Solutions Architect & Founder
Samuel Watua Soita dropped an excellent point recently about how AI is rewriting the economics of phishing. The takeaway is clear: We can no longer train users to spot fakes when the fakes are mathematically perfect copies. Traditional awareness training looks at the perimeter—b…
The next phishing email might not look like phishing at all. For years, security awareness training taught us to look for obvious warning signs: Bad grammar. Strange formatting. Suspicious links. Unusual requests. But AI is changing the economics of social engineering. An attack…
We still train people to spot a suspicious email? Is that still a thing? What about the Teams message from “IT,” the MFA reset call, the wapp or LI message that looks normal, or the fake CAPTCHA ... Social engineering has moved way beyond email. But has security awareness traini…
Identity is part of the attack surface. A compromised account is only dangerous because of what that account can access. So during an investigation, don't stop at: “Which account was compromised?” Ask: → What privileges did it have? → What systems could it reach? → What data cou…
One stolen password can become an entire security incident. The problem isn't always the password itself. It's what that identity can reach. A compromised account may provide access to: → Email and collaboration tools → Cloud consoles → Internal applications → Customer informati…
The attacker doesn't have to be smarter than your security team. They just need to be quieter. Most organizations invest heavily in prevention. Firewalls. EDR. MFA. SIEM. WAF. IDS/IPS. And rightly so. But security controls don't eliminate risk. They create signals. The real ques…
OAuth & MCP Investigation Checklist: 4 Steps to Assess Risk As organizations adopt OAuth-connected applications and Model Context Protocol (MCP) integrations, it's important to evaluate how these connections could expose sensitive data or increase attack surface. 1. Inventory Co…
The most dangerous alert in a SOC might be the one that looks completely normal. An employee logs in. A legitimate PowerShell command executes. A service account accesses a database. An administrator creates a new API token. Nothing immediately looks malicious. But cybersecurity…
Cybersecurity is changing — and the attacker doesn't always need malware anymore. One of the most important shifts in the current threat landscape is the move from “break in” to “log in.” Attackers increasingly target: → Stolen credentials → Session tokens and cookies → MFA enro…
Schomer — Principal Security Solutions Architect & Founder
Modern attacks don't always look like attacks. A compromised employee account can authenticate normally. A stolen session token can bypass the login process entirely. An attacker with valid credentials can move through systems without triggering the alarms you expected. This is…
Schomer — Principal Security Solutions Architect & Founder
The reason our framework handles edge infrastructure variance natively where standard automation drops the ball is simple: we validate the execution boundary at Layer Zero, pre-authentication. Look at what happened this month with Cisco and NetScaler—major enterprises burned tho…
Module 7: System Hacking is live on iscsecurity.org. This is the module after vulnerability analysis: moving from a prioritized target list to active exploitation, privilege escalation, and domain dominance. Gaining initial access, bypassing local defenses, dumping credentials,…
Schomer — Principal Security Solutions Architect & Founder
The Changed Locks Paradigm and the Blind Spot of Identity We need to talk about the tactical reality behind the ongoing FortiBleed infrastructure panic. The FBI and Secret Service didn't issue an emergency joint advisory because threat actors are writing complex, flashy zero-day…
Why Everyone Should Turn On MFA A strong password is important, but a password alone is not enough. Multi-Factor Authentication (MFA) adds an extra layer of security by requiring two or more forms of verification before access is granted. For example: 🔑 Something you know: Pass…
People are socially and naturally motivated to seek opportunities for joint action. Similarly companies and organizations seek economically motivated partnerships, joint ventures or other M&A activities to form strategic alliances. These are indispensable for accessing specializ…