Practical Guides

The Cyber Craft Blog

Plain-English guidance for cybersecurity, AI risk, practical cleanup, and the technical decisions growing teams need to make.

AIUC-1 Q2 2026 shows where agent governance is heading

The market is moving from AI policy paperwork to approved interfaces, verified identities, logged actions, and monitored third-party access.

Read article

Which First Step Makes Sense: Baseline Review, Operations Security Review, or Pen Test?

A practical guide to choosing the right first engagement when you need progress, not an over-scoped security project.

Read article

Network Segmentation on a Budget: How to Isolate Your Most Sensitive Systems

How to implement VLANs and firewall rules on equipment you already own. Separate guest WiFi, cameras, servers, and workstations into cleaner segments.

Read article

How to Run a Tabletop Security Exercise in 60 Minutes

A practical tabletop exercise kit with scenarios, prompts, and a scoring rubric for teams that need a useful drill without hiring a facilitator.

Read article

What a Security Scorecard Actually Tells You

What your grade means, what it misses, and when to use a fast scan as the start of a real cleanup plan.

Read article

Vendor Risk Assessments for Small Businesses: A Practical Guide

A simple way to review vendors, remote access, shared responsibility, and the outside parties that quietly become part of your attack surface.

Read article

Our NIST Comment on AI Agent Identity and Authorization

We filed a formal comment with the NIST NCCoE on AI agent identity and authorization. Here's what we said and why it matters for the MCP ecosystem.

Read article

CraftedTrust Touchstone: Building a CVE Research Engine for the MCP Ecosystem

Touchstone is CraftedTrust's security research authority for MCP servers, spanning scans, advisories, disclosures, and certification support.

Read article

75% of CISOs Are Securing AI with Yesterday's Tools

Pentera's 2026 benchmark report reveals most organizations rely on legacy security controls for AI. Here is what needs to change, backed by data from 300 US CISOs.

Read article

AI Agents as Attack Surface: What MCP, Tool Use, and Agent Chains Mean for Security

AI agents can browse, execute code, and make API calls. Each capability is an attack surface. Mapping the threats from prompt injection to supply chain risk.

Read article

Security Assessments Explained: What Small Businesses Should Expect

A practical guide to what a professional security assessment covers, what the deliverables look like, and how to use the findings.

Read article

Penetration Testing Guide: What It Is, What It Is Not, and When to Use It

A plain-English guide to how pen testing works, what you should expect from a real engagement, and when a different first step is smarter.

Read article

Secure Coding Practices Every Developer Should Know (With Real Vulnerabilities)

OWASP Top 10 with real code examples in Python and JavaScript. Vulnerable code vs. fixed code, plus Semgrep scanning and pre-commit hooks.

Read article

IoT Security for Small Offices: Printers, Cameras, and the Devices No One Patches

Every office has IoT devices nobody thinks about. How to find them with Nmap, segment them onto a VLAN, and set up firmware update schedules.

Read article

OAuth Misconfigurations That Let Attackers Into Your App

The 7 most exploited OAuth/OIDC misconfigurations with code examples showing the vulnerability and the fix. Open redirects, PKCE, token storage, and more.

Read article

Deepfakes in the Boardroom: How Real-Time AI Impersonation Actually Works

Live deepfakes are being used in Zoom calls to authorize wire transfers. The technology, the detection artifacts, and a practical verification protocol.

Read article

Data Classification: The Security Step Everyone Skips

You can't protect data you haven't classified. A 4-tier system, inventory process, and handling rules for every classification level.

Read article

The Board Wants a Cybersecurity Report. Here's What to Actually Put in It.

5 metrics that matter, how to translate technical findings to financial risk language, and what to say when the board asks "are we secure?"

Read article

Container Security: How to Stop Your Docker Images from Leaking Secrets

Top 10 container security mistakes and how to fix each one. Dockerfile templates, Trivy scanning, and Kubernetes NetworkPolicy examples.

Read article

Third-Party Vendor Risk Assessment: A Practical Guide for Small Teams

A vendor risk workflow for teams without a GRC department. Scoring vendors, security questionnaires, and contract clauses that protect you.

Read article

Agentic AI Is Breaking IAM - How to Authenticate Non-Human Identities

AI agents make API calls and access databases, but IAM was built for humans. OAuth2 client credentials, short-lived tokens, and agent permission matrices.

Read article

How Malicious Extensions Steal Your AI Conversations - A Technical Breakdown

Deep technical analysis of fetch overrides, DOM scraping, data staging, and C2 exfiltration. How 6-factor risk scoring catches each pattern.

Read article

What Your Security Score Actually Means (And How to Fix It)

A plain-English breakdown of the seven checks in a website security scan. Learn what SSL, SPF, DMARC, DKIM, and security headers do and how to fix common gaps.

Read article

Chrome Extension Security: What Every User Should Know

How Chrome extensions access your data, real-world incidents from the 2025-2026 AI chat harvesting wave, and how multi-factor risk scoring catches malicious patterns.

Read article

Penetration Testing: What It Is, Why You Need It, and How to Prepare

A practical guide to penetration testing for businesses. Learn what to expect, how to scope an engagement, and how to get the most value from your pentest.

Read article

Enterprise AI Security Checklist: 10 Controls You Need Before Deploying AI

A practical checklist for securing AI deployments in enterprise environments. Covers data protection, model security, access controls, and compliance.

Read article

Why Your AI Conversations Aren't as Private as You Think

9M+ users had AI chats harvested by malicious extensions in 90 days. How content script interception works, why AI conversations are high-value targets, and what to do about it.

Read article

How We Score MCP Servers: A 12-Factor Trust Framework

MCP connects AI agents to external tools - but who verifies the servers? We built a 12-factor CoSAI-aligned scoring system across 4,274+ servers to bring transparency to the protocol.

Read article

Running Your First Security Assessment: NIST, ISO 27001 & Beyond

You don't need a six-figure consulting engagement to understand your security posture. Here's how to get started with the major frameworks - for free.

Read article

The Permission Problem: Why Browser Extensions Are a Blind Spot

Most users install extensions without reading permissions. What "read and change all your data on all websites" actually means, and why your AI chats are the most valuable target.

Read article

SBOM: Why Every Piece of Software Will Need an Ingredient Label

SBOMs are becoming mandatory for government vendors. What they are, SPDX vs CycloneDX, and how to generate and scan one with free tools.

Read article

Supply Chain Attacks: From SolarWinds to Your npm install

The software supply chain is the most underdefended attack surface in modern computing. Here is how attackers exploit it and what you can do today.

Read article

The Identity Crisis: Why Credential Theft Is Now the #1 Attack Vector

82% of attacks are now malware-free, relying on stolen credentials and identity abuse. How credentials reach the dark web and how to harden your identity posture.

Read article

AI Governance in 2026: What Every Business Needs to Know

The EU AI Act is live, the SEC wants AI disclosures, and your customers want transparency. A practical guide to AI governance without the legalese.

Read article

Holiday Scam Season: The Technical Anatomy of a Modern Phishing Kit

How phishing kits actually work: typosquatting, Let's Encrypt trust, HTML cloning, reverse proxy credential harvesting, and Telegram bot exfiltration.

Read article

2025 in Cybersecurity: The Year AI Changed Everything

From the biggest breaches to the most important policy shifts, here is what defined cybersecurity in 2025 and what it means for 2026.

Read article

Shadow AI: Your Employees Are Using AI Tools You Don't Know About

Employees are pasting proprietary data into AI tools without IT's knowledge. How to discover unauthorized AI usage and build an acceptable use policy.

Read article

DNS Security: The Most Overlooked Layer of Defense

DNS is the backbone of the internet, and it is almost never secured. Here is why DNS attacks are so effective and what protective DNS can do for you.

Read article

Cyber Insurance in 2025: What's Covered, What's Not, and How to Get a Better Rate

What your policy actually covers, what's excluded, the 12 controls insurers require, and how better security can reduce your premium 15-30%.

Read article

Building a Security Culture That Doesn't Suck

Security awareness training is universally hated. Here is how to build a security culture that employees actually engage with instead of resent.

Read article

Threat Modeling for People Who Hate Threat Modeling

STRIDE made accessible. Walk through a real SaaS login flow, compare frameworks, and get a 1-hour workshop format any team can run.

Read article

Prompt Injection: The New SQL Injection

SQL injection dominated the 2000s. Prompt injection is the equivalent for the AI era. Here is how it works, why it is hard to fix, and what defenders need to know.

Read article

Ransomware Defense Playbook: What to Do Before, During, and After an Attack

A complete operational playbook covering prevention, active incident response, and recovery. Includes the 3-2-1-1 backup rule and a pay/don't pay framework.

Read article

The Hidden Cost of Free Software: What You're Really Paying

If you are not paying for the product, you ARE the product. Here is how free tools monetize your data and what to look for before you install.

Read article

MFA Isn't Bulletproof - How Attackers Bypass Two-Factor Authentication

The 5 main MFA bypass techniques in active use: SIM swapping, AitM proxies, push bombing, SS7 interception, and session theft. Which methods are actually phishing-resistant.

Read article

API Security in the Age of AI Agents

AI agents are making thousands of API calls per minute. Most APIs were not built for this. Here is what breaks and how to fix it.

Read article

How to Build an Incident Response Plan When You Don't Have a Security Team

A complete IR plan template for organizations with no dedicated security staff. Detection, containment, recovery, customer notification, and when to call law enforcement.

Read article

Why Small Businesses Are the #1 Target for Cyberattacks

43% of cyberattacks target small businesses. Most don't have dedicated security staff. Here is why attackers prefer small targets and what you can do.

Read article

Cloud Misconfiguration Is the #1 Cause of Data Breaches - How to Audit Yours

The most common cloud misconfigurations, CLI commands to find public-facing storage, a 10-item audit checklist, and a 30-minute monthly routine.

Read article

Zero Trust Architecture: Beyond the Buzzword

Everyone talks about Zero Trust. Few understand it. Here is what it actually means, why it matters for small businesses, and how to start implementing it.

Read article

Passkeys Are Replacing Passwords - Here's What You Need to Know

How passkeys work, why they eliminate phishing by design, and step-by-step setup for Google, Apple, and Microsoft accounts.

Read article

The Rise of AI-Powered Social Engineering

Deepfakes, voice cloning, and GPT-generated phishing - AI is supercharging social engineering attacks. Here is what changed and how to adapt.

Read article