security

"We get pentested so we're secure"

Why the annual pentest is a snapshot with no predictive value, how the industry puts junior testers on template reports, and what a good pentest actually is.

The password is dead and nobody has the decency to tell you

Password rotation is a fifteen-year-old superstition. Here's why it survives, why it never worked, and what to do this afternoon.