Florian D.

Jun 17, 2026

A password is like underwear.

I know. Not what you expected to read on Cyberr.

But now that the image is in your head, it's staying there. Which is exactly the point. 😏

Because in cybersecurity, the problem is almost never technical. It's human.

You can stack firewalls, EDRs and group policies all you want: if the password is sitting on a sticky note under the keyboard, none of it matters.

So let's go through it, one step at a time:

-> You don't hand it out. Not to the colleague who "just needs 2 minutes." Not to "support, just to verify."

-> You don't leave it at your desk. The sticky note under the keyboard is the all-time classic. We find it in 4 seconds during an audit.

-> Size matters. And counterintuitively: length protects you far more than special characters. i-love-my-blue-bike-2024 is tougher to crack than P@ss!2. A passphrase beats gibberish nobody can remember.

-> You change it… when you actually need to. And no, not every 90 days "on principle", that rule is dead (NIST, ANSSI). You rotate on a confirmed breach or real suspicion. The rest of the time, you turn on MFA and breathe.

The real best practice today? A password manager + MFA everywhere. Now you only have one pair to keep track of. The right one.

👇 Tell me in the comments: the sticky note under the keyboard, have you ever actually spotted one at your company? (Be honest.)

At Humanix, we believe cyber is human before it's technical. No fear, no jargon: just reflexes that hold up.

#Cybersecurity #Passwords #SMB #NIS2 #SecurityAwareness #HumanixCybersecurity

View post

Jun 4, 2026

🇪🇺 90% of cyberattacks against an SMB go through a human.

90% of the tools to train them come from the US, cost $8,000/year, and host your data on Microsoft Azure.

We built the opposite.

Here are the 5 features that make Humanix Académie different from yet another KnowBe4 clone.

🎯 PHISHING ENGINE V2 — full Gophish-style funnel

Tracking sent → opened → clicked → submitted → reported. Not just "they clicked". A/B variants to compare two templates on the same cohort. Drip campaigns to spread sending across 7 days (avoids the open-space "wave" that tips off employees). Custom landing pages + built-in SPF/DKIM/DMARC check.

🤖 4 SOVEREIGN AI FEATURES — Mistral, made in Paris

→ Personalized debrief after a click (Mistral reads the learner's history: firm tone for repeat offenders, encouraging for a first-time slip)

→ Red Team mode: describe your industry context, the AI generates a full scenario (subject + sender + HTML body + teaching points)

→ Narrative vulnerability scoring per learner (4 tiers: low / medium / high / critical)

→ Mistral grader on Outlook reports: rewards real vigilance, not signal-spam

🛡️ MULTI-FRAMEWORK COMPLIANCE PROVED BY CODE GDPR · NIS2 · ISO 27001:2022 · SOC 2 (AICPA TSC) · NIST CSF · ANSSI Hygiene 42 measures (French baseline). Technical mapping

versioned in the repo, OSCAL v1.1.2 exports directly importable into CISO Assistant. Not marketing — auditable code.

📋 OPERATIONAL DPO WORKSPACE

90-day GDPR dashboard, art. 17 erasure queue, pre-filled DPIA generator, per-tenant retention config, JSON connector to OneTrust / Didomi / Privacy.fr / Dastra. Your DPO finally gets a tool, not just an Excel sheet.

🎮 GAMIFICATION THAT ACTUALLY STICKS

10 levels (Novice → Master), 53 badges, an evolving mascot, an in-app shop with endgame items at 6,000 coins. Reaching "Master" requires ~88 % of the catalog — a real trophy, not a marketing

freebie.

—

🇪🇺 EU-sovereign stack: Scaleway Paris · Mistral Paris · Mollie Amsterdam. Zero Cloud Act exposure.

🆓 AGPLv3 open source — auditable and self-hostable.

→ Try it without signup: demo.humanix-academie.fr

→ Free AI maturity check: humanix-academie.fr/maitrise-ia

#cybersecurity #SMB #GDPR #NIS2 #DPO #SOC2 #SovereignAI

#SecurityAwareness #OpenSource #DataSovereignty #EUTech

View post

Jun 3, 2026

We let people who don't do the job choose the words for us. And it's starting to feel good.

A hacker is not a pirate.

A hacker hacks, it diverts, it understands how things work to fix them, improve them, secure them. It brings solutions.

A pirate is the opposite: it's harmful, period. To confuse the two is to insult an entire culture.

And while we're at it, let's talk about the titles.

"Cybersecurity Engineer". It doesn't mean anything.

You are at SOC, or you are offensive, or you are in RCMP, or you are doing purple. They are different jobs, different skills, different brains. We are not "computer scientists", this suitcase word has not existed for a long time.

The same goes for "DevOps engineer". It doesn't mean anything either. Either you are a system admin and you automate. Either you are a dev and you secure your production and your dev cycle thanks to the pipelines you set up. Choose. Assume.

Let's regain control of the words. Titles. And especially of our passions.

Because yes, they are passion jobs. Not HR boxes.

The day we let others define who we are, we have already lost half of what is the strength of this community.

#Cybersécurité #Hacker #DevSecOps #SOC #RedTeam #GRC

View post