CyphrQThe Data Breach Lifecycle: From First Access to Notification
How a data breach unfolds, from initial access and dwell time to containment and notification, with 2026 figures from IBM, Mandiant and Verizon.
Threats & Defence
How attacks work today and the defences that hold, for the people who run the systems.
12 articles
Infostealers and Session Cookie Theft: Why MFA Isn't Enough
Infostealer malware can copy a logged-in session and skip MFA. How session cookie theft works, and the controls that make a stolen token useless.
Insider Threat Program: Types, Warning Signs and Privacy Limits
How to build an insider threat program: CISA's insider types, warning signs, least privilege, logging and DLP, HR and legal roles, and lawful monitoring.
Ransomware Decryption Tools: What No More Ransom Can and Can't Do
Free ransomware decryptors exist for some families only. What No More Ransom offers, why paying guarantees nothing, and the backups that matter more.
How Ransomware Attacks Work, and the Controls That Stop Them
How ransomware attacks unfold, from first access to encryption and extortion, and the backup, identity and patching controls that break the chain.
SIEM vs SOC: The Tool, the Team, and Which One You Need
A SIEM is a log platform; a SOC is the team that acts on it. Build, buy or hybrid, which logs to collect first, how long to keep them, and staffing.
Red Team vs Blue Team vs Purple Team: Who Needs Which, and When
Red, blue and purple teaming explained, regulator-led tests such as CBEST, TIBER-EU and DORA TLPT, how to scope one, and what a good report contains.
ZTNA vs VPN: Why Remote Access Gateways Get Breached
Why VPN appliances are a favourite way in, what zero trust network access changes, the order to migrate in, and what ZTNA does not fix.
Fileless Malware and Living off the Land: How to Detect It
Fileless attacks run through tools already on your systems, such as PowerShell and WMI. Why antivirus misses them, and how to detect and respond.
API Security Breaches: How Data Leaks Through APIs and How to Stop It
How attackers pull data out through APIs, mapped to the OWASP API Security Top 10 2023, two documented cases, and the controls that work.
Breach Detection Tools Explained: EDR, XDR, NDR, MDR and SIEM
What EDR, XDR, NDR, MDR, SIEM and deception tools each see, what they miss, and the telemetry and staff they need. With CISA and NIST sources.
What Is the Dark Web? How It Works, Who Uses It and the Risks
The dark web explained: how it differs from the deep web, who uses it, what stolen data is sold there, and what to do if your company data shows up.