Field notes.

Research, incident write-ups and practical guidance from our testers and responders. No vendor fluff.

Earth at night from orbit with glowing city lights

Threat reportOct 3, 202614 min read

Q3 2026 threat landscape: infostealers outpace ransomware

Across 410 client environments, stolen session cookies were the initial access vector in 38% of incidents. Here is what changed and what to do about it.

Read the report

Hooded figure lit by a teal monitor in a dark room

Incident responseOct 1, 202611 min read

Inside a ransomware negotiation: 72 hours with a LockBit affiliate

IdentitySep 24, 20267 min read

MFA fatigue is back. Here is how we beat it on a 4,000-seat tenant

ResearchSep 16, 20269 min read

Mapping a supply-chain attack path from one npm package

ComplianceSep 9, 20266 min read

What NIS2 actually asks of a 200-person SaaS company

PentestingAug 30, 20268 min read

Five findings we see in nearly every API pentest

AwarenessAug 21, 20265 min read

Building a phishing programme employees do not hate

Newsletter

The Sentinel Signal.

One email every other Thursday: new CVEs that matter, our latest research and one practical fix. 11,000 security leaders subscribe.