Cybersecurity
Let's discuss your project →Cybersecurity assessment for SMEs: what to include in scope, evidence, and quote
A practical guide for SME owners and IT managers on scoping a cybersecurity assessment, separating it from scans and pentests, and comparing quotes on evidence and ownership.
Learn more →Supplier bank detail changes: how to test a defence against fraudulent emails
Test supplier bank-detail checks step by step with a simulated email, roles, answers and record: no real payments or contacts.
Learn more →Digital offboarding: a verifiable checklist when an employee leaves
A practical offboarding checklist for IT teams: disable the identity, revoke sessions and tokens, reassign document ownership, and verify residual sharing, with platform-specific limits.
Learn more →Software Dependency Alerts: From Notification to a Verifiable Update Decision
A practical workflow for turning a Dependabot alert into a traceable decision: assign ownership, update or defer with reasons, then verify the deployed artifact.
Learn more →CSV exports: check formulas before opening data in a spreadsheet
OWASP explains that untrusted CSV content may be interpreted as formulas by spreadsheet software. This guide shows a safe validation flow, a harmless test case, and practical acceptance checks.
Learn more →Integration permissions: a practical check of least privilege
A practical check for least privilege in integrations: define the task, compare requested permissions with actual function, test allowed and denied actions, and record exceptions with a review date.
Learn more →A leaked API key in a repository: prevention and the revocation path
A practical GitHub-focused guide on preventing leaked secrets, simulating a safe incident workflow, revoking exposed credentials, rotating replacements, and understanding the limits of push protection.
Learn more →Passkeys at work: test access, recovery, and offboarding in the pilot
A passkey pilot should test lost-device recovery and account offboarding, not only everyday sign-in. This short operational checklist helps verify the full flow before expanding to the team.
Learn more →Ransomware: a table-top exercise to clarify who decides in the early stages
A ransomware simulation can expose missing contacts and decisions with no clear owner. Here is a scenario to discuss without touching real systems.
Learn more →Cisco Secure Email Gateway: SQL injection flaw under active exploitation
Cisco’s advisory cisco-sa-esa-inj-2bLVGmhX describes an actively exploited SQL injection in Cisco Secure Email Gateway. This article keeps the scope narrow, explains the high-level mechanism, distinguishes patching from remediation, and provides a small-business-ready checklist.
Learn more →What GitHub’s npm and Actions update means for small software teams
An English analysis of GitHub’s 28 July 2026 supply chain security update on npm and GitHub Actions, distinguishing observed attack behavior, already implemented mitigations, and announced follow-up work. The article focuses on the defensive checks a small or mid-sized company should ask of its team or vendor on accounts, workflows, caches, dependencies, and incident response.
Learn more →Dependabot will drop Python 3.9 support: what to check before the deadline | Dedaloop
From 23 June 2026, GitHub Dependabot will no longer support Python 3.9. A practical checklist for software, DevOps and security teams that need to avoid disruptions in dependency updates.
Learn more →GitHub expands OIDC for Dependabot and code scanning: fewer static secrets in the software supply chain | Dedaloop
GitHub extends OIDC support for Dependabot and code scanning to Cloudsmith and Google Artifact Registry. What changes for DevOps, security and dependency governance.
Learn more →KnowledgeDeliver ViewState vulnerability: the operational risk of shared secrets | Dedaloop
The case analysed by Mandiant on KnowledgeDeliver shows why reused ASP.NET keys in deployment templates can turn into large-scale compromise scenarios.
Learn more →OpenAI Daybreak and AI for cybersecurity: from finding to remediation | Dedaloop
OpenAI introduces Daybreak, Codex Security and GPT-5.5-Cyber to support vulnerability discovery, validation and patching. What changes for DevSecOps, governance and technical teams.
Learn more →AI and open source security: what Patch the Planet teaches software teams | Dedaloop
OpenAI’s initiative shows how AI can support vulnerability management, patching and open source supply chains. But governance, human review and solid DevSecOps pipelines remain essential.
Learn more →Phishing-as-a-Service with AI and real-time OTP capture: what changes for enterprise defense | Dedaloop
Google Threat Intelligence’s analysis of Chinese-language PhaaS shows more automated, localized phishing capable of bypassing OTP-based MFA. Organizations need to move from awareness-only programs to phishing-resistant technical controls.
Learn more →