Category: Whitepaper Expansion
-
Lessons from 2025: What Red Team Exercises Should Actually Test in 2026
TLDR Major 2025 breaches exposed critical gaps in traditional red team exercises. While organizations tested for technical vulnerabilities, real-world compromises succeeded through different attack paths. The three patterns: third-party helpdesk social engineering (Marks & Spencer’s £300M ransomware attack), supply chain attacks (Salesloft Drift breach, Shai-Hulud NPM worm), and internet-exposed industrial systems with default passwords (critical
-
M&A Deal Risk: Acquiring a Company Mid-Incident (And How Diligence Should Change)
TLDR Most M&A technical due diligence assumes you’re evaluating a stable security posture. But sophisticated breaches can remain undetected for months, meaning you might be acquiring a company mid-incident without knowing it. Standard diligence questionnaires and compliance reports won’t find active compromises. Here’s what changes when you need to verify you’re not inheriting an ongoing
-
Post-Incident Threat Hunting: Finding What Automated Tools Missed
TLDR After a security incident, automated tools tell you what happened. Threat hunting tells you what else happened. Most organizations stop investigating once their EDR and SIEM systems identify the initial compromise. Attackers count on this. Organizations that stop investigating once automated tools identify the initial breach leave attackers’ backup access in place. Drawing from
-
Satine Sentinel: December 12, 2025
Attackers weaponized the developer toolchain this week (again!). GitHub repositories masquerading as OSINT tools sat on trending lists for months before dropping RATs on security professionals. React Server Components—the framework primitive powering modern web applications—went from vulnerability disclosure to 35,000 daily exploitation attempts in seven days, forcing CISA to issue emergency deadlines. Microsoft patched a
-
Ransomware Response Beyond Backups: Technical Realities Security Vendors Won’t Tell You
TLDR Three weeks after restoring from backups and declaring their ransomware incident resolved, a regional healthcare provider discovered attackers still had domain admin access. The encryption had been reversed. Systems appeared functional. Yet the threat actor had maintained persistence through credential compromise and backdoor accounts that backup restoration never touched. The real incident was just
-
The First 48 Hours: What Offensive Security Experience Reveals About Incident Response
TLDR Adversaries establish multiple persistence mechanisms, move laterally, and exploit blind spots within the first 48 hours of compromise. Most incident response plans focus on containing initial access before understanding the full scope. Three critical gaps emerge: IR teams treat initial compromise as the complete incident while attackers have already established redundant access; lateral movement
-
Satine Sentinel: December 5, 2025
Nation-state actors dominated this week’s incident landscape, and they’re operating at every layer of the stack. PRC-linked groups are sitting inside VMware infrastructure for 17 months while simultaneously weaponizing a React zero-day within hours of disclosure. DPRK operators are running ransomware through criminal affiliates and draining cryptocurrency exchanges to fund weapons programs. Meanwhile, two separate
-
How Shai-Hulud Learned to Evade Everything That Caught It
In September 2025, Shai-Hulud compromised over 500 npm packages, generating security advisories from CISA, analysis from every major security vendor, and widespread coverage across developer communities. Package maintainers were warned. Security teams implemented additional scanning. The npm ecosystem was on alert. Ten weeks later, Shai-Hulud 2.0 compromised 796 packages totaling over 20 million weekly downloads.
-
Red Team Findings That Predict Incident Response Success (Or Failure)
TLDR Red team engagements reveal which organizations will successfully contain real breaches and which will face catastrophic incidents. The predictive indicators are clear: detection speed, response timelines, lateral movement visibility, backup integrity, and stakeholder coordination under pressure. Organizations that can’t detect simulated attacks within 24-48 hours won’t catch sophisticated adversaries moving at operational speed. Those
-
Incident Response Economics: What Security Teams Miss in Their Preparedness Planning
TLDR Most organizations budget for incident response tools and retainers but ignore the real costs: business disruption during recovery, decision-making delays, and the technical debt that makes incidents worse. True preparedness means calculating the economics of your response capability before you need it. Introduction In September 2023, MGM Resorts lost $100 million to a ransomware