This is a post to explain why PornHub’s extortion story matters far beyond adult content. This is the same phishing led analytics failure that exposed OpenAI customer data and impacted…
Read More
This is an account takeover attack that bypasses phishing detection, malware controls, and authentication safeguards. It exploits legitimate authorisation workflows exactly as designed. There is currently no technical control that…
Read More
Here’s a good example of a security vendor claiming to offer a Zero Trust firewall that’s fundamentally different from everything else on the market. Technically, it isn’t. The same claim…
Read More
This article sits in the middle of an important exchange between Paul Rohan, Aidan Herbert, and my earlier post on PSD3, instant payments, and upstream fraud prevention. Paul challenged the…
Read More
By the end of this article you’ll understand why fraud, account takeovers, and data theft keep rising, why all of today’s conventional security systems are failing to protect everyone from…
Read More
The Gist Reuters reported on the new PSD3 agreement and the increased pressure it will place on banks to prevent fraud even as instant payments remove their ability to pause…
Read More
There’s a widespread belief that criminals using AI changes something about phishing detection. It doesn’t. And the reason it doesn’t is so simple that most people overlook it. Let’s start…
Read More
90% of cybercrime begins with phishing and it usually comes down to one moment. A person interacts with a link they can’t assess after it slips past the security tools…
Read More
I came across a LinkedIn article about an OAuth phishing attack, and I want to explain why it’s far simpler than the security industry makes it sound. The article is…
Read More
Think about how you move through your digital life. Every time a text arrives, you pause. Every time an email lands, you hesitate. Every time you see an offer on…
Read More