Post-quantum readiness starts with knowing your certificates
The latest certificate research points to a practical first step: know what depends on your existing trust systems before changing them.
Read article →Useful ideas for the work ahead.
Security, AI and everyday technology, with a focus on what it means for your team and what you can do next.
News articles link to their sources and show the reporting date. Guides help you think through a task or decision in more detail.
In focus · July 21, 2026What the OpenAI agent sandbox breach means for businesses65 articles
AI can find more bugs. Your fix process still has to work.
Recent research shows progress in automated vulnerability discovery. The useful question for a business is how findings become verified fixes.
Read article →A real remote-support installer can still be the wrong one
A recent phishing campaign used legitimate remote-management software. Verify the request and the access being granted, as well as the file.
Read article →AI-assisted attacks are shortening the response window
Google's September threat report described attackers moving from prompts to agent workflows. Clear ownership and fast containment matter when activity accelerates.
Read article →The PaperCut zero-days showed why office systems need an owner
Active attacks on PaperCut NG and MF brought print-management servers into the security response. Include office systems in exposure, update, and recovery plans.
Read article →The Cypress incident put secrets in test data back on the agenda
A third-party analytics incident affected Cypress data and some embedded credentials. Review what your development tools record, retain, and share.
Read article →OpenAI's agent sandbox breach: what businesses should take from it
The OpenAI and Hugging Face incident showed how an evaluation agent could cross real security boundaries. The business lesson is to test the controls around every tool and credential.
Read article →The SharePoint attacks made patching and recovery one conversation
CISA warned about active attacks on on-premises SharePoint. A patch closes a vulnerability; investigation establishes what happened before it arrived.
Read article →The 2026 DBIR lesson: patch paths matter more than dashboards
Verizon's 2026 DBIR points to vulnerability exploitation, ransomware, mobile threats, and AI-augmented attacks. The practical response is a disciplined patch path.
Read article →Agentic workflows make CI/CD the new blast radius
GitHub's June 2026 agentic workflow and Actions security updates show why AI coding agents need CI/CD permissions, triggers, caches, and secrets reviewed as one security boundary.
Read article →The MCP security crisis is really a third-party access problem
CSA's May 2026 MCP research is a reminder that MCP servers should be governed like connected vendors: inventory, permissions, monitoring, and revocation.
Read article →CISA's agentic AI guide turns adoption into control work
CISA's May 2026 agentic AI guidance gives teams a practical control checklist: low-risk starts, limited privilege, usable logs, human fallback, and stronger oversight.
Read article →AIUC-1 Q2 2026 shows where agent governance is heading
AIUC-1's Apr. 15, 2026 update shows the market shift from AI policy binders to approved tools, verified identities, logged actions, and monitored third parties.
Read article →AI agent access: who can do what?
Know which accounts an AI agent uses, what it can reach and how to remove access. A practical guide to permissions and audit trails.
Read article →Know what access a vendor really needs
A practical way for a small team to review a vendor’s access, ask useful security questions and record the decisions behind a connection.
Read article →AI agents: check the tools and access around them
Look at the tools, permissions and connections around an AI agent, then decide where a tighter boundary or human check would help.
Read article →Rehearse a security incident before it happens
Use a 60-minute discussion exercise to practice roles, decisions and communication before your team has to handle a real incident.
Read article →Network Segmentation for Small Business: IoT and Guest Wi-Fi
Separate IoT devices, guest Wi-Fi, and staff computers with a practical VLAN plan, firewall rules, and a small-office network example.
Read article →Security checks to bring into your code reviews
Walk through vulnerable and improved code examples, then bring focused security checks into your development and review process.
Read article →The office devices that need an owner
Bring printers, cameras, smart screens and other connected office devices into your inventory, update plan and access reviews.
Read article →OAuth mistakes worth checking before release
Work through OAuth and OIDC examples involving redirects, PKCE and token handling, with code showing where mistakes can happen.
Read article →Introducing the CraftedTrust Agent Trust Stack: 5 Layers of AI Agent Security
Research archive describing an earlier five-layer CraftedTrust architecture. The active product is now the focused public MCP registry.
Read article →CraftedTrust Now Maps to 5 Major Compliance Frameworks
Research archive mapping MCP trust signals to CoSAI, OWASP, EU AI Act, NIST AI RMF, and AIUC-1. The current registry does not issue compliance assessments.
Read article →When a familiar face asks for an unusual payment
How real-time impersonation can affect business calls, and why payment requests need a verification path beyond a familiar voice or face.
Read article →On-Chain Trust: How EAS Attestations Make AI Agent Certifications Verifiable
Research archive exploring EAS attestations for machine-verifiable AI agent certification. This is not part of the current CraftedTrust registry offering.
Read article →Our NIST Comment on AI Agent Identity and Authorization
We filed a formal comment with the NIST NCCoE on AI agent identity and authorization. Here's what we said and why it matters for the MCP ecosystem.
Read article →State of MCP Server Security 2026
March 2026 research snapshot of MCP server security, including grade distributions, authentication gaps, and common failures. Current coverage appears in the live registry.
Read article →CraftedTrust Touchstone: Building a CVE Research Engine for the MCP Ecosystem
Research archive describing an earlier Touchstone CVE research concept. The active CraftedTrust product is now the public MCP registry.
Read article →Why AI Agents Should Pay for Trust Verification (and How x402 Makes It Possible)
Research archive exploring x402 micropayments for agent-native trust verification. Payment-gated verification is not part of the current CraftedTrust registry.
Read article →Know which business data needs the most care
Sort business information into useful categories, then agree who can use it, where it belongs and how it should be handled.
Read article →AI security needs more than a familiar toolkit
What Pentera’s 2026 benchmark suggests about the gap between familiar security tools and the access AI workflows need.
Read article →Security reports that help the board decide
Turn technical findings into a useful discussion of business impact, priorities and decisions that need leadership’s attention.
Read article →Keep secrets and avoidable risk out of containers
Review image contents, privileges and network access, with practical examples for finding issues in Docker and Kubernetes setups.
Read article →How a browser extension can capture AI chat data
A technical look at how malicious extensions can read AI conversations, stage data and send it elsewhere, with controls to investigate.
Read article →Your security score: what to check next
Understand the six public checks in the Cyber Craft Scorecard, how incomplete results are handled and which follow-up questions to ask.
Read article →Choose browser extensions with their access in mind
Check what an extension can access, who maintains it and whether your team still needs it. A practical starting point for browser security.
Read article →What a browser extension can see in your AI chats
Before sharing business information in an AI chat, check what your browser extensions can read and how to reduce unnecessary access.
Read article →What a useful penetration test should give you
Know what to ask before a test, how to agree the boundaries and how to use the findings to choose practical security improvements.
Read article →How We Score MCP Servers: A 12-Factor Trust Framework
How the CraftedTrust public registry separates 12 categories of MCP trust evidence, scan depth, confidence, and age before connection.
Read article →Before you connect AI to business data
Work through practical questions about AI data, permissions, human review and ownership before connecting a tool to everyday work.
Read article →Turn security questions into a practical to-do list
Use representative security questions to find what needs a closer look. Understand what the questionnaire can show and what it cannot verify.
Read article →Before you click “Add extension”
Understand what browser permissions allow an extension to read or change, and decide which access is worth granting.
Read article →Know what’s inside the software you rely on
Use a software bill of materials to understand dependencies, with examples of creating an inventory and checking it for known issues.
Read article →Check the dependencies your business relies on
Follow the software and services behind your systems, and review how a compromised dependency could affect your business.
Read article →Stolen accounts can bypass familiar defenses
Understand how stolen passwords and session tokens are used, then review the sign-in protections and access your business relies on.
Read article →AI governance: make the rules useful
Make AI use easier to oversee with clear ownership, approved tools and data rules that your team can follow.
Read article →What 2025’s security stories mean for your team
A look back at 2025’s security events and policy changes, with questions to bring into your planning for 2026.
Read article →Phishing kits: what to check before trusting a page
Look inside a phishing kit and learn why a familiar-looking page or an HTTPS connection is not enough to establish trust.
Read article →DNS security: a practical place to check
Understand how DNS affects the connections your business makes, then look at the protections and settings worth reviewing.
Read article →Make AI use easier to see and manage
Find out where AI is being used in everyday work, then agree approved tools, data boundaries and a process for trying useful ideas.
Read article →Make security easier to do, every day
Help people report concerns, make safer choices and practice the steps that matter in their day-to-day work.
Read article →Cyber insurance in 2025: questions to ask
An introduction to policy exclusions, security questions and the evidence to discuss with your insurer before choosing coverage.
Read article →Find the weak spots before you build
Walk through a SaaS sign-in example and use a short workshop to identify threats, discuss tradeoffs and decide what needs protection.
Read article →When untrusted text becomes an AI instruction
See how prompt injection crosses the boundary between information and instructions, and which controls need a closer look.
Read article →Ransomware: plan for prevention and recovery
Work through preparation, response and recovery, including backups, responsibilities and the decisions your team may need to make.
Read article →Before you install a free business tool
Look beyond the price tag at data collection, permissions and ongoing costs before adding a free tool to your working day.
Read article →Give AI agents the API access they actually need
Review how an AI agent uses your APIs, what it can reach and which requests need tighter limits or a person’s approval.
Read article →How attackers get around MFA, and what to check
Compare common MFA bypass techniques and review which sign-in methods resist phishing, alongside the account and session controls around them.
Read article →An incident response plan your small team can use
Make the first calls, responsibilities and recovery steps easier to find when something goes wrong. A starting template for small teams.
Read article →Small business security: where to start
Look at common account, email and backup risks for a small business, and choose practical protections around the systems you depend on.
Read article →Zero Trust: make access decisions clearer
Understand the ideas behind Zero Trust and use them to review which people and devices need access to your business systems.
Read article →Cloud permissions: find what’s open too widely
A practical checklist for reviewing public storage, permissions and other cloud settings that can expose more than you intended.
Read article →Passkeys: how they work and where to start
Understand the sign-in process behind passkeys and the questions to consider before introducing them to your business.
Read article →AI makes a convincing request easier to fake
Look at voice cloning, deepfakes and AI-written messages, then plan a reliable way to verify an unusual business request.
Read article →Workflow review, automation build, or deeper security test?
Choose a workflow review, AI or automation build, network review, or authorized penetration test around the business problem.
Read article →No articles match that search. Try a different topic or clear the search.