Security for the systems your business runs on, in plain terms.
Field notes, threat breakdowns and practical guidance from the MBCTG team.
One AI Model Ran the Full Kill Chain. A Week Later There Were Two.
Booz Allen scored 18 frontier AI models against a live network. One finished the intrusion alone, and a week later a second one did too.
The OT Guide Your Auditor Cites Is Being Rewritten. You Have Until 30 November.
NIST's SP 800-82r4 draft restructures OT security guidance around CSF 2.0 and moves the overlay out. Comments close 30 November 2026.
Your Network Is Segmented. Thirteen Percent of the OT Segments Are OT Only.
Forescout mapped 47,700 real network segments. Only 13 percent of those holding OT devices held nothing else. What that does to blast radius.
Your OT Program Scored Itself Mature. One in Five Can List the Assets.
Honeywell surveyed 603 OT security leaders. 88 percent called their programs mature, 21 percent hold a complete asset inventory. What that gap costs.
Your CRA Reporting Clock Starts at Awareness. Nobody Owns That Moment.
The CRA's 24 hour reporting duty went live on 11 September along with ENISA's platform. What the clock measures, who starts it, where filings go.
Your Remote Site Router Checked Half the SSH Key. Attackers Took Admin.
MikroTrick chains two RouterOS flaws into unauthenticated admin. Shadowserver counted 122,500 devices with SSH exposed. What to check this week.
Your Industrial VPN Client Takes Configuration From Anyone. It Runs as Root.
CVE-2026-75925 scores 9.6. IXON's industrial VPN client wrote unauthenticated config to a file a root process then executed. What to check now.
Your AI Coding Agent Already Ran Code. You Never Approved It.
A routine background git call let seven AI coding agents run attacker code without an approval prompt. Weeks later, four of the flaws are still open.
361 Victim IPs, 47 Countries, Five Days: Inside the CVE-2026-59310 Campaign
A critical vCenter flaw was exploited five days after its patch and reached 361 victim IP addresses in 47 countries. What it did and what to check now.
