https://craftedcybersolutions.com/blog/ Practical cybersecurity, AI, and technology news analysis. en-us Mon, 12 Oct 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/agentic-ai-attacks-shorten-response-window.html News date: 2026-09-08. Google's September threat report described attackers moving from prompts to agent workflows. Clear ownership and fast containment matter when activity accelerates. https://craftedcybersolutions.com/blog/agentic-ai-attacks-shorten-response-window.html Mon, 12 Oct 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/ai-vulnerability-research-needs-a-fix-path.html News date: 2026-10-07. Recent research shows progress in automated vulnerability discovery. The useful question for a business is how findings become verified fixes. https://craftedcybersolutions.com/blog/ai-vulnerability-research-needs-a-fix-path.html Mon, 12 Oct 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/cypress-metabase-incident-secrets-in-test-data.html News date: 2026-08-12. A third-party analytics incident affected Cypress data and some embedded credentials. Review what your development tools record, retain, and share. https://craftedcybersolutions.com/blog/cypress-metabase-incident-secrets-in-test-data.html Mon, 12 Oct 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/openai-agent-sandbox-breach-containment.html News date: 2026-07-21. The OpenAI and Hugging Face incident showed how an evaluation agent could cross real security boundaries. The business lesson is to test the controls around every tool and credential. https://craftedcybersolutions.com/blog/openai-agent-sandbox-breach-containment.html Mon, 12 Oct 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/papercut-zero-days-office-systems.html News date: 2026-08-27. Active attacks on PaperCut NG and MF brought print-management servers into the security response. Include office systems in exposure, update, and recovery plans. https://craftedcybersolutions.com/blog/papercut-zero-days-office-systems.html Mon, 12 Oct 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/post-quantum-certificate-readiness.html News date: 2026-10-08. The latest certificate research points to a practical first step: know what depends on your existing trust systems before changing them. https://craftedcybersolutions.com/blog/post-quantum-certificate-readiness.html Mon, 12 Oct 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/remote-support-phishing-permission-check.html News date: 2026-09-29. A recent phishing campaign used legitimate remote-management software. Verify the request and the access being granted, as well as the file. https://craftedcybersolutions.com/blog/remote-support-phishing-permission-check.html Mon, 12 Oct 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/sharepoint-exploitation-patching-and-recovery.html News date: 2026-07-14. CISA warned about active attacks on on-premises SharePoint. A patch closes a vulnerability; investigation establishes what happened before it arrived. https://craftedcybersolutions.com/blog/sharepoint-exploitation-patching-and-recovery.html Mon, 12 Oct 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/dbir-2026-patch-paths.html Verizon's 2026 DBIR points to vulnerability exploitation, ransomware, mobile threats, and AI-augmented attacks. The practical response is a disciplined patch path. https://craftedcybersolutions.com/blog/dbir-2026-patch-paths.html Fri, 26 Jun 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/agentic-workflows-ci-cd-blast-radius.html GitHub's June 2026 agentic workflow and Actions security updates show why AI coding agents need CI/CD permissions, triggers, caches, and secrets reviewed as one security boundary. https://craftedcybersolutions.com/blog/agentic-workflows-ci-cd-blast-radius.html Thu, 11 Jun 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/mcp-security-crisis-third-party-access.html CSA's May 2026 MCP research is a reminder that MCP servers should be governed like connected vendors: inventory, permissions, monitoring, and revocation. https://craftedcybersolutions.com/blog/mcp-security-crisis-third-party-access.html Sat, 23 May 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/cisa-agentic-ai-adoption-controls.html CISA's May 2026 agentic AI guidance gives teams a practical control checklist: low-risk starts, limited privilege, usable logs, human fallback, and stronger oversight. https://craftedcybersolutions.com/blog/cisa-agentic-ai-adoption-controls.html Thu, 07 May 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/aiuc-1-q2-2026-agent-governance.html AIUC-1's Apr. 15, 2026 update shows the market shift from AI policy binders to approved tools, verified identities, logged actions, and monitored third parties. https://craftedcybersolutions.com/blog/aiuc-1-q2-2026-agent-governance.html Thu, 16 Apr 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/agentic-ai-identity-management.html AI agents are making API calls, accessing databases, and acting on behalf of users, but IAM was designed for humans. Here is how to authenticate agents, scope permissions, and audit every action. https://craftedcybersolutions.com/blog/agentic-ai-identity-management.html Fri, 10 Apr 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/vendor-risk-assessment-guide.html A practical vendor risk assessment workflow for small teams without a GRC department. Learn how to score vendors, ask the right security questions, and add protective clauses to your contracts. https://craftedcybersolutions.com/blog/vendor-risk-assessment-guide.html Fri, 10 Apr 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/ai-agent-mcp-attack-surface.html AI agents using MCP, function calling, and tool chains introduce new attack surfaces. Learn the specific threats and how to defend against them. https://craftedcybersolutions.com/blog/ai-agent-mcp-attack-surface.html Wed, 08 Apr 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/tabletop-exercise-guide.html A complete 60-minute tabletop exercise kit with facilitator guide, three ready-to-use scenarios, discussion prompts, scoring rubric, and post-exercise report template. No external facilitator needed. https://craftedcybersolutions.com/blog/tabletop-exercise-guide.html Mon, 06 Apr 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/network-segmentation-guide.html Learn how to implement network segmentation using VLANs and firewall rules on equipment most small businesses already own. Separate guest WiFi, IoT devices, servers, and workstations into isolated segments. https://craftedcybersolutions.com/blog/network-segmentation-guide.html Sat, 04 Apr 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/secure-coding-practices.html Walk through the OWASP Top 10 with real vulnerable vs fixed code examples in Python and JavaScript. Includes Semgrep scanning, pre-commit hooks, and a 10-point secure coding checklist for code reviews. https://craftedcybersolutions.com/blog/secure-coding-practices.html Thu, 02 Apr 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/iot-security-small-office.html Your office is full of IoT devices nobody thinks about. Printers, cameras, smart TVs, and VoIP phones are common attack targets. Here's how to find and secure them. https://craftedcybersolutions.com/blog/iot-security-small-office.html Tue, 31 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/oauth-misconfigurations.html The 7 most exploited OAuth and OIDC misconfigurations, from open redirect callbacks to missing PKCE. Includes code examples showing each vulnerability and the fix. https://craftedcybersolutions.com/blog/oauth-misconfigurations.html Sun, 29 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/agent-trust-stack.html Research archive describing an earlier five-layer CraftedTrust architecture. The active product is now the focused public MCP registry. https://craftedcybersolutions.com/blog/agent-trust-stack.html Fri, 27 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/compliance-framework-mappings.html Research archive mapping MCP trust signals to CoSAI, OWASP, EU AI Act, NIST AI RMF, and AIUC-1. The current registry does not issue compliance assessments. https://craftedcybersolutions.com/blog/compliance-framework-mappings.html Fri, 27 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/deepfake-detection-business.html Real-time deepfakes are being used in Zoom calls to impersonate executives and authorize wire transfers. Learn how the technology works, how to detect artifacts, and how to build a verification protocol that stops deepfake fraud. https://craftedcybersolutions.com/blog/deepfake-detection-business.html Fri, 27 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/eas-onchain-trust.html Research archive exploring EAS attestations for machine-verifiable AI agent certification. This is not part of the current CraftedTrust registry offering. https://craftedcybersolutions.com/blog/eas-onchain-trust.html Fri, 27 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/nist-ai-agent-identity.html We filed a formal comment with the NIST NCCoE on AI agent identity and authorization. Here's what we said and why it matters for the MCP ecosystem. https://craftedcybersolutions.com/blog/nist-ai-agent-identity.html Fri, 27 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/state-of-mcp-security-2026.html March 2026 research snapshot of MCP server security, including grade distributions, authentication gaps, and common failures. Current coverage appears in the live registry. https://craftedcybersolutions.com/blog/state-of-mcp-security-2026.html Fri, 27 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/touchstone-cve-research.html Research archive describing an earlier Touchstone CVE research concept. The active CraftedTrust product is now the public MCP registry. https://craftedcybersolutions.com/blog/touchstone-cve-research.html Fri, 27 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/x402-agent-micropayments.html Research archive exploring x402 micropayments for agent-native trust verification. Payment-gated verification is not part of the current CraftedTrust registry. https://craftedcybersolutions.com/blog/x402-agent-micropayments.html Fri, 27 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/data-classification-guide.html You can't protect data you haven't classified. Learn a practical 4-tier classification system, how to inventory data assets, and how to map each tier to specific handling rules. https://craftedcybersolutions.com/blog/data-classification-guide.html Wed, 25 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/ai-security-gap-2026.html Pentera's 2026 benchmark report reveals most organizations rely on legacy security controls for AI. Here is what needs to change, backed by data from 300 US CISOs. https://craftedcybersolutions.com/blog/ai-security-gap-2026.html Mon, 23 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/cybersecurity-board-reporting.html Boards don't care about CVE counts. They care about business risk. Learn the 5 metrics that matter, how to translate technical findings into financial risk language, and what to say when the board asks if you're secure. https://craftedcybersolutions.com/blog/cybersecurity-board-reporting.html Mon, 23 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/container-security-docker.html The top 10 container security mistakes teams make with Docker and Kubernetes, from secrets in images to running as root. Practical fixes with Dockerfile templates, Trivy scanning, and NetworkPolicy examples. https://craftedcybersolutions.com/blog/container-security-docker.html Sat, 21 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/malicious-extensions-technical-breakdown.html Deep technical analysis of how malicious Chrome extensions intercept AI chat data, covering fetch overrides, DOM scraping, data staging, and C2 exfiltration techniques used in real-world campaigns. https://craftedcybersolutions.com/blog/malicious-extensions-technical-breakdown.html Fri, 20 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/security-scorecard-explained.html A plain-English breakdown of the seven checks in a website security scan. Learn what SSL, SPF, DMARC, DKIM, and security headers do and how to fix common gaps. https://craftedcybersolutions.com/blog/security-scorecard-explained.html Fri, 20 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/chrome-extension-security.html How Chrome extensions access your data, the risks they pose, and practical steps to protect yourself from malicious browser extensions. https://craftedcybersolutions.com/blog/chrome-extension-security.html Sun, 15 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/ai-chat-privacy.html Real incidents prove browser extensions are harvesting AI conversations at scale. Learn how content script interception works, why AI chats are high-value targets, and how to protect yourself. https://craftedcybersolutions.com/blog/ai-chat-privacy.html Thu, 12 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/penetration-testing-guide.html A practical guide to penetration testing for businesses. Learn what to expect, how to scope an engagement, and how to get the most value from your pentest. https://craftedcybersolutions.com/blog/penetration-testing-guide.html Thu, 12 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/mcp-trust-scoring.html How the CraftedTrust public registry separates 12 categories of MCP trust evidence, scan depth, confidence, and age before connection. https://craftedcybersolutions.com/blog/mcp-trust-scoring.html Tue, 10 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/ai-security-checklist.html A practical checklist for securing AI deployments in enterprise environments. Covers data protection, model security, access controls, and compliance. https://craftedcybersolutions.com/blog/ai-security-checklist.html Sun, 08 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/security-assessment-guide.html How to evaluate your security posture against NIST, ISO 27001, CIS Controls, SOC 2, and PCI-DSS - for free. https://craftedcybersolutions.com/blog/security-assessment-guide.html Sun, 08 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/browser-extension-risks.html Most users install browser extensions without reading permissions. Here's why that matters and what 'read and change all your data' actually means. https://craftedcybersolutions.com/blog/browser-extension-risks.html Thu, 05 Mar 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/sbom-software-bill-of-materials.html SBOMs are becoming mandatory for software transparency. Learn what a Software Bill of Materials is, how to generate one with Syft, scan it with Grype, and why federal mandates make this urgent in 2026. https://craftedcybersolutions.com/blog/sbom-software-bill-of-materials.html Thu, 19 Feb 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/supply-chain-attacks.html The software supply chain is the most underdefended attack surface in modern computing. Here is how attackers exploit it and what you can do today. https://craftedcybersolutions.com/blog/supply-chain-attacks.html Tue, 10 Feb 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/credential-theft-identity-attacks.html CrowdStrike found 79% of 2024 intrusions were malware-free, using stolen credentials and session tokens instead. Learn why identity replaced malware as the primary attack vector and how to protect your organization. https://craftedcybersolutions.com/blog/credential-theft-identity-attacks.html Thu, 15 Jan 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/ai-governance-2026.html The EU AI Act is live, the SEC wants AI disclosures, and your customers want transparency. A practical guide to AI governance for businesses of every size. https://craftedcybersolutions.com/blog/ai-governance-2026.html Tue, 13 Jan 2026 00:00:00 +0000 https://craftedcybersolutions.com/blog/cybersecurity-year-review-2025.html From the biggest breaches to the most important policy shifts, here is what defined cybersecurity in 2025 and what it means for 2026. https://craftedcybersolutions.com/blog/cybersecurity-year-review-2025.html Mon, 22 Dec 2025 00:00:00 +0000 https://craftedcybersolutions.com/blog/holiday-phishing-kit-anatomy.html A technical deep-dive into how modern phishing kits work: domain typosquatting, HTTPS certificate abuse, HTML cloning, credential harvesting via reverse proxy, session token replay, and Telegram-based exfiltration. Five checks to spot a phishing site in under 10 seconds. https://craftedcybersolutions.com/blog/holiday-phishing-kit-anatomy.html Thu, 11 Dec 2025 00:00:00 +0000 https://craftedcybersolutions.com/blog/dns-security-overlooked.html DNS is the backbone of the internet, and it's almost never secured. Here's why DNS attacks are so effective and what protective DNS can do for you. https://craftedcybersolutions.com/blog/dns-security-overlooked.html Mon, 17 Nov 2025 00:00:00 +0000 https://craftedcybersolutions.com/blog/shadow-ai-risk.html Employees are pasting proprietary code, customer data, and strategy docs into unauthorized AI tools. Learn how to discover shadow AI usage, build an approved tool list, and write an AI acceptable use policy that works. https://craftedcybersolutions.com/blog/shadow-ai-risk.html Thu, 13 Nov 2025 00:00:00 +0000 https://craftedcybersolutions.com/blog/building-security-culture.html Security awareness training is universally hated. Here's how to build a security culture that employees actually engage with instead of resent. https://craftedcybersolutions.com/blog/building-security-culture.html Mon, 20 Oct 2025 00:00:00 +0000 https://craftedcybersolutions.com/blog/cyber-insurance-guide.html A practical guide to cyber insurance for small businesses in 2025. Learn what's covered, what's excluded, the security controls insurers require, and how to reduce your premium by 15-30%. https://craftedcybersolutions.com/blog/cyber-insurance-guide.html Thu, 16 Oct 2025 00:00:00 +0000 https://craftedcybersolutions.com/blog/threat-modeling-guide.html STRIDE doesn't have to be painful. Walk through a real SaaS login flow example, compare frameworks, and get a ready-to-run 1-hour workshop format your team can use today. https://craftedcybersolutions.com/blog/threat-modeling-guide.html Thu, 18 Sep 2025 00:00:00 +0000 https://craftedcybersolutions.com/blog/prompt-injection-attacks.html SQL injection dominated the 2000s. Prompt injection is the equivalent for the AI era. Here's how it works, why it's hard to fix, and what defenders need to know. https://craftedcybersolutions.com/blog/prompt-injection-attacks.html Mon, 15 Sep 2025 00:00:00 +0000 https://craftedcybersolutions.com/blog/ransomware-defense-playbook.html A complete operational playbook for ransomware defense covering prevention, active incident response, and recovery. Includes the 3-2-1-1 backup rule, pay-or-don't-pay framework, and post-incident hardening. https://craftedcybersolutions.com/blog/ransomware-defense-playbook.html Thu, 14 Aug 2025 00:00:00 +0000 https://craftedcybersolutions.com/blog/hidden-cost-free-software.html If you're not paying for the product, you ARE the product. Here's how free tools monetize your data and what to look for before you install. https://craftedcybersolutions.com/blog/hidden-cost-free-software.html Mon, 11 Aug 2025 00:00:00 +0000 https://craftedcybersolutions.com/blog/api-security-ai-agents.html AI agents are making thousands of API calls per minute. Most APIs weren't built for this. Here's what breaks and how to fix it. https://craftedcybersolutions.com/blog/api-security-ai-agents.html Mon, 21 Jul 2025 00:00:00 +0000 https://craftedcybersolutions.com/blog/mfa-bypass-attacks.html Five MFA bypass techniques actively used by attackers: SIM swapping, AitM phishing proxies, MFA fatigue, SS7 interception, and session token theft. Learn which MFA methods are phishing-resistant and how to protect your accounts. https://craftedcybersolutions.com/blog/mfa-bypass-attacks.html Fri, 18 Jul 2025 00:00:00 +0000 https://craftedcybersolutions.com/blog/incident-response-plan-small-business.html A complete, practical incident response plan template for small businesses without dedicated security staff. Covers detection, containment, eradication, recovery, and post-incident review. https://craftedcybersolutions.com/blog/incident-response-plan-small-business.html Thu, 12 Jun 2025 00:00:00 +0000 https://craftedcybersolutions.com/blog/small-business-cyber-targets.html 43% of cyberattacks target small businesses. Most don't have dedicated security staff. Here's why attackers prefer small targets and what you can do about it. https://craftedcybersolutions.com/blog/small-business-cyber-targets.html Mon, 09 Jun 2025 00:00:00 +0000 https://craftedcybersolutions.com/blog/zero-trust-explained.html Everyone talks about Zero Trust. Few understand it. Here's what it actually means, why it matters for small businesses, and how to start implementing it today. https://craftedcybersolutions.com/blog/zero-trust-explained.html Mon, 19 May 2025 00:00:00 +0000 https://craftedcybersolutions.com/blog/cloud-misconfiguration-audit.html Cloud misconfigurations like public S3 buckets and overly permissive IAM roles cause more breaches than any other vector. Learn how to audit your cloud environment with a practical 10-item checklist. https://craftedcybersolutions.com/blog/cloud-misconfiguration-audit.html Thu, 15 May 2025 00:00:00 +0000 https://craftedcybersolutions.com/blog/passkeys-replacing-passwords.html Passkeys explained: how public-private key pairs eliminate phishing by design, how to enable them on Google, Apple, and Microsoft, and what businesses need to know about WebAuthn in 2025. https://craftedcybersolutions.com/blog/passkeys-replacing-passwords.html Sun, 20 Apr 2025 00:00:00 +0000 https://craftedcybersolutions.com/blog/ai-social-engineering.html Deepfakes, voice cloning, and GPT-generated phishing - AI is supercharging social engineering attacks. Here's what changed and how to adapt. https://craftedcybersolutions.com/blog/ai-social-engineering.html Mon, 14 Apr 2025 00:00:00 +0000