• category
Every post filed under this category, newest first.
Cyber attack cost UK, line by line: response, downtime, ICO exposure, supplier claims and brand damage. See which exposures drive the bill.
Stealer logs expose passwords, cookies and session tokens. Follow a 48-hour triage sequence to revoke, contain and report. See the full runbook.
Capita ICO fine explained beyond the £14m headline: the six exposure gaps it exposes and how UK teams close them. See what to fix first.
NCSC adversary simulation guidance explained: how CyAS differs from pen testing, what to fix before scoping, and the data a red team needs. Read the guide.
Check Point VPN vulnerability response done properly: find every gateway, confirm the hotfix and catch stolen VPN logins. See the checklist.
Cyber Security and Resilience Bill: what in-scope firms and MSPs must prove, from 24-hour reporting to asset inventory. See the checklist.
Harrods data breach explained: what was taken, how a supplier let it happen, and six checks to stop the same gap hitting you. See the 30-day plan.
Third party data breach risk hides in gaps annual vendor checks never test. See the five blind spots and how to monitor suppliers continuously.
Stealer logs expose employee passwords, cookies and session tokens. Get a 72-hour triage runbook and see why resets alone fail. Start free.
VIP monitoring done properly: how to choose which executives need cover, the exposure signals to watch, and how to act on findings. See how to set it up.
Third party breach hitting your data? Get the early warning signals, a 72-hour UK response runbook and the contract fixes that stop a repeat.
CVE-2026-19490 is a critical authentication bypass vulnerability in NetScaler ADC and Gateway. It refers to an authentication flaw that could potentially become a major security threat if not addressed promptly.
Explore the anatomy of a fourth-party data breach, examining the risks associated with Metabase, Framework, and n8n and how to mitigate them.
In the interconnected world of industrial operations, cyber threats can emerge unexpectedly. This post explores how a forgotten VPN at a wind farm compromised Siemens PLCs at a heat plant and the importance of robust cybersecurity strategies.
A comprehensive analysis of the vCenter Syslog Flaw, its potential impacts, and mitigation strategies.
CVE-2026-8037 is a critical (CVSS 9.6) unauthenticated command injection flaw in Progress Kemp LoadMaster, disclosed on 4 June 2026 and added to CISA’s KEV catalogue on 7 August 2026 after telemetry recorded 792 exploitation attempts from 65 IP addresses over 41 days. Attackers can execute arbitrary OS commands on unpatched appliances without credentials.
Explore the critical TeamCity CVE-2026-63077 vulnerability, actively exploited as confirmed by CISA. Learn about its implications, mitigation strategies, and how organisations can protect themselves.
73% of organisations lack adequate incident response capabilities. This blog explores the gaps in visibility and coordination, offering solutions to enhance readiness and resilience.
Exploration of Azure Cosmos DB critical vulnerability, CosmosEscape, highlighting the risks of shared infrastructure in cloud computing.
Cisco FMC static credentials vulnerability CVE-2026-20316 actively exploited. Immediate patching needed by August 1 deadline. Exploit details and remediation steps.
Explore the hidden risks of cloud misconfiguration and exposed services, and learn strategies to protect your organisation.
Explore the UK’s Cyber Security and Resilience Bill and its impact on your organisation’s attack surface.
Explore how third-party vendors, supply chains, and SaaS applications contribute to attack surface expansion and discover strategies for minimisation.
Learn practical steps to reduce your external attack surface and enhance cybersecurity.
Exploring the cyber attack surface trends of 2026 and how businesses can mitigate potential threats.
This blog emphasises the importance of maintaining certificate and DNS hygiene to prevent cyber threats such as dangling records, expired certificates, and subdomain takeover.
This article discusses the limitations of patching in vulnerability management and explores comprehensive strategies for improving security posture, such as continuous monitoring and threat intelligence.
Explore the key differences between EASM, CAASM, and DRPS in cybersecurity to make informed decisions for your organisation’s security strategy.
A guide for AppSec leaders to mitigate risks from CVE-2026-12569 in high-stakes sectors like finance, healthcare, and energy.
Explore Adversarial Exposure Validation (AEV) and its role in Continuous Threat Exposure Management (CTEM) for prioritizing real exploitability over mere visibility in cybersecurity.
Discover how the China-nexus group Velvet Ant conducted a decade-long infiltration of Linux login systems in "Operation Highland," using backdoors in PAM and OpenSSH to maintain persistence.
Explore the NCSC’s ‘Vulnerability Patch Wave’ campaign to enhance cybersecurity with proactive vulnerability management. Learn why visibility and prioritization are key to effective patching.
An analysis of the May 2026 GitHub breach, highlighting the vulnerabilities it exposed and lessons about software security.
Organisations often overlook validating if a fix for vulnerabilities is effective, leaving them exposed. This blog explores the verification gap, its risks, and offers a framework for ensuring remediation effectiveness.
Understanding your real attack surface through 45 days of monitoring reveals hidden vulnerabilities and optimises security measures. Discover key insights and improve your cybersecurity posture.
GlassWorm is a resurgence of malicious VS Code extensions that expands attack surfaces by targeting developer machines holding sensitive credentials and code, evading traditional security detection. Learn detection and mitigation tips.
Passkeys represent the future of secure authentication, replacing vulnerable passwords with device-specific cryptographic keys integrated with biometrics, promising enhanced security and user convenience.
In this blog, we explore China-linked cyber threats, their risks, and comprehensive defence strategies including cyber hygiene, intelligence, and policy roles to combat these sophisticated threats.
Ghost identities are dormant or obsolete user accounts that pose significant risks to enterprise data security. Identifying and eliminating these accounts through audits, tools, and strict access controls is crucial to safeguard sensitive information.
As AI regulations rise globally, understanding their impact on your cybersecurity attack surface is crucial. This blog covers increased attack surface complexity, enhanced monitoring, data protection, and vendor risk management strategies to stay compliant and secure.
Explore how effective supplier risk management mitigates cybersecurity risks in global supply chains to protect company assets and reputation.
This blog explores the rise of AI-driven phishing and highlights the importance of External Attack Surface Management (EASM) in countering these sophisticated threats. Discover how organisations can enhance their cybersecurity resilience against AI-enhanced phishing attacks.
EASM and SIEM/SOAR are not competing technologies, but complementary forces in modern cybersecurity. When integrated effectively, EASM acts as the watchtower, identifying risks and blind spots that SIEM and SOAR alone might miss. By feeding that intelligence into your security stack, you gain sharper visibility, faster detection, and more confident response capabilities. DarkInvader’s EASM platform exemplifies this approach, offering continuous, actionable insight that enriches SIEM and SOAR workflows, transforming data into strategic defence. In the evolving landscape of cyber threats, that visibility could be the difference between a close call and a costly breach.
Most businesses are still relying on outdated spreadsheets and incomplete lists to track their digital assets. That’s no longer enough. The smallest overlooked change could be the cause of the next major breach. By embracing real-time monitoring and proactive external attack surface management, businesses can finally gain control over their ever-changing online presence. DarkInvader’s EASM platform gives you that visibility and peace of mind, helping you stay one step ahead of the threats you can’t afford to ignore.
The meaning of “attack surface” varies depending on who you ask. For some, it is limited to servers and systems. For others, it encompasses people, devices, and shadow IT. DarkInvader brings a more complete perspective, focusing on both what could be attacked and the information that could increase the success of that attack. This dual lens highlights the real scale of risk in a connected world. By mapping the attack surface and gathering intelligence, DarkInvader’s EASM platform gives defenders the insight they need to stay ahead.
Website takedowns are a crucial part of protecting brands and customers from fraudulent activity. While they appear simple in principle, the execution requires experience, attention to detail, and careful communication with registrars and hosting providers. DarkInvader makes this process seamless by gathering complete evidence, preparing thorough requests, and navigating the nuances of registrar communication, ensuring that takedowns are both efficient and effective.
Security debt is the silent risk many organisations are accumulating without realising it. Like technical debt, it builds up over time and becomes harder to manage the longer it’s ignored. By adopting EASM, improving visibility, and embedding security into the development culture, businesses can keep this hidden liability under control before it becomes a very public crisis.
The UK Cyber Security and Resilience Bill aims to modernise national cyber defence by mandating continuous security practices across digital sectors. It will affect a broad range of organisations and demand improved risk management, resilience, and accountability. EASM plays a vital role in achieving compliance and maintaining visibility. The smart move? Start now.
External Attack Surface Management (EASM) is often treated as a technical concern, but it is fast becoming a strategic issue for executive boards. As cyber risks multiply and reputational stakes rise, EASM gives leadership the visibility needed to govern digital exposure effectively. This blog explores why boardrooms can no longer afford to ignore what attackers see first, the external attack surface.
Even mature businesses with a strong handle on their public facing assets can be caught off guard by change. Exposed ports, misconfigured services, and forgotten systems can appear online without warning, and attackers are always watching. Continuous attack surface monitoring is essential, and without it, you are relying on luck more than defence.
The Rebel Alliance’s destruction of the Death Star was not blind luck; it was the result of intelligence-led analysis and targeting of a hidden flaw. Today, EASM solutions play the same role for businesses: identifying overlooked assets and exposures on your external digital footprint. Much like the trench run, success comes down to knowing exactly where the risk lies.
Typo-squatting is about much more than spelling mistakes. Attackers register lookalike domains mainly to send phishing emails, not just to trick people who mistype. Domains with MX records, live websites, redirects, and even restricted content responses should all be prioritised for investigation. Adding extra words to domains can make them even more convincing than small typos. Businesses need to monitor both registered and unregistered risks, and using an EASM platform makes this possible at scale.
Zero trust is not about being paranoid. It’s about being realistic. In a time when networks have no clear edges and attackers are everywhere, assuming nothing and verifying everything just makes sense. Combined with EASM, it gives businesses both visibility and control – inside and out.
Global threat intelligence has huge potential, but many businesses struggle to use it effectively. The data is often too complex, too noisy, and too disconnected from their environment. DarkInvader’s upcoming Global Threat Intelligence modules aim to change that by curating only the most relevant information and cross-referencing it with the business’s own data. It helps security teams prioritise the right actions, without the burden of endless analysis.
PSN ITHCs are intense, often unclear, and heavily manual. While EASM tools can’t directly replace the pen testing required, they align beautifully with the broader goals of the PSN framework. They give you clear visibility of your external risk, make pre-check clean-up easier, and help maintain a better security posture year-round. It’s not a shortcut, but it’s definitely a smart companion.
Supply chain attacks are on the rise because cybercriminals know that the easiest way into a business is often through its partners. Many organisations focus on internal security while neglecting their vendors, contractors, and third-party software providers. Hackers use OSINT to map out these weak points and exploit them. To stay secure, businesses need stronger third-party risk management, better vendor security policies, and a shift in mindset, because in today’s interconnected world, your security is only as strong as your weakest supplier.
Fake social media accounts are more than just an inconvenience. They can be used for phishing, fraud, and reputational damage, posing a risk not only to individuals but to the businesses they work for. Automated tools can help, but they aren’t always enough. That’s why an EASM solution like DarkInvader, which supplements automation with expert human research, is essential for identifying and mitigating these hidden threats.
Misconfigured AWS S3 buckets are one of the easiest yet most damaging security risks out there. Hackers use simple methods to find exposed data, and once they do, the consequences can be severe. But with the right tools and monitoring, organisations can stay ahead of the threats. DarkInvader’s EASM platform ensures that misconfigured S3 buckets don’t slip through the cracks, because if your data is out there, you need to know before the hackers do.
Aligning with NIST 2.0 using EASM tools like DarkInvader strengthens your cybersecurity posture, streamlines incident response, and demonstrates security leadership.
Relying solely on supplier security questionnaires can create a false sense of security. They often rely on self-assessment, which can be biased, outdated, or incomplete. Continuous monitoring offers a dynamic, real-time view of supplier security, ensuring businesses are better protected against evolving threats. While questionnaires have their place, they should be complemented with proactive monitoring for a more comprehensive security strategy.
Businesses often overlook the first step of EASM – discovery. Without a clear inventory of public-facing assets, organisations are left vulnerable to Shadow IT and potential breaches. Continuous discovery and monitoring are essential, and platforms like DarkInvader’s EASM solutions are here to help. Knowing your assets isn’t optional – it’s critical.
Public-facing ports often fly under the radar for many businesses, but they can pose significant security risks if left unchecked. Ports meant for internal use, such as database and firewall configuration tools, should never be exposed to the internet. Changes to your attack surface can happen quickly and without warning, making continuous monitoring essential. Tools like the DarkInvader portal can help businesses discover, track, and secure their public-facing assets, providing the visibility needed to stay ahead of potential threats. Remember, you can’t protect what you don’t know exists.
Cyber intelligence equips IT teams with actionable insights to counter emerging threats, anticipate vulnerabilities, and adopt a proactive approach to cybersecurity. While the advantages are clear, organisations have frequently been slow to embrace cyber intelligence tools. Key barriers include cost considerations, integration difficulties, a shortage of skilled professionals, and complex privacy and compliance requirements. This blog examines the transformative impact of cyber intelligence on IT operations and explores the factors behind the slower rate of adoption among organisations.
World War I marked one of the earliest instances of intelligence being systematically integrated into warfare, laying the groundwork for many of the practices we recognise today. Both the Allies and Central Powers developed innovative intelligence strategies to gain an edge, utilising signals interception, code-breaking, espionage, and aerial reconnaissance. Businesses today can derive valuable lessons from these early intelligence practices, particularly in strategic planning, competitive analysis, and data-driven decision-making. Understanding the origins of intelligence can reveal timeless strategies for modern businesses to anticipate challenges, outmanoeuvre competitors, and drive strategic growth in a data-centric era.
As organisations’ digital footprints expand, relying solely on periodic penetration testing is no longer enough to ensure robust security. External Attack Surface Management (EASM) complements penetration testing by providing continuous monitoring and a comprehensive view of the organisation’s exposed assets. Together, these two approaches ensure that vulnerabilities are discovered and addressed in real-time, while also benefiting from the deeper insights offered by manual penetration tests. By adopting both, organisations can move from a reactive to a proactive security strategy, ensuring that their defences keep pace with the ever-changing threat landscape.
This blog highlights the top 5 tips in Continuous Threat Exposure Management and how it works, talking through the stages and benefits of this.
This blog highlights the top four challenges in External Attack Surface Management and how to safeguard your sensitive digital assets.
This post summarises what External Attack Surface Management is and the benefits as well as the challenges that come with it.
This blog outlines the new DORA requirements, specifically navigating third-party risks due to the new DORA compliance set for January 2025.
In light of National Apprenticeship Week, this blog summarises Yusefs and Sams apprenticeship journeys here at DarkInvader and how they started their careers in cyber security. Read this blog to find out their career journeys.
This blog outlines what Typo Squatting is and the dangers associated with it as well as how to protect yourself against all types of TypoSquatting.
This blog highlights the roles of domain security in Phishing prevention and how you can create an environment where Phishing attempts are recognised and reported to avoid the risk of falling victim to these attacks.
This blog explores the risk mitigation strategies for modern IT teams and types of risk mitigations. Have a read of our blog to delve into this topic.
This blog explains the role of EASM and the differences between Attack Surface Management and Vulnerability Management.
This blog acts as a guide for executives faced with cyber extortion and other cyber threats that executives are at risk of.
This blog explains how deploying your EASM Solution can strengthen your security posture along with the benefits and limitations of this.
This blog explains the role of External Attack Surface Management (EASM) and how our EASM assessment helps managers predict and plan for future security.
To ensure your online safety, it is essential to understand the potential risks and learn how to protect your online identity effectively. By following a few simple steps and adopting good online habits, you can significantly reduce the chances of falling victim to identity theft and other cybercrimes. This article will provide you with valuable insights and practical tips on how to safeguard your online identity.
This blog covers the lessons learnt from Sony’s Recent Incident and how businesses can learn from this.
This blog covers what Human Attack Surface is and how to mitigate risks efficiently and effectively. Have a listen to our ThreatBite episode to learn more about this topic.
This blog covers what attack surface management is and how attack surface management means. This blog also covers the difference between attack surface management and attack surface mapping.
This article discusses the Russia - Ukraine cyber war and its implications for global security. It explores the challenges and opportunities of attribution and deterrence in addressing such conflicts and how geopolitical, economic and social contexts shape their respective cyber strategies.
This blog covers Attack Surface Reduction Rules and how this helps to reduce risk including what factors should be considered when implementing ASRR.
This blog summarises protecting your digital identity online and how you can do this by following the basic but essential cyber security practices. Read this blog for a guide to how to protect yourself on social media and online.
This blog covers how attack surface management works and why its becoming more popular amongst organisations now. Have a read of this blog to find out more about the benefits of ASM.
This blog is a guide to what attack surface management is and why its so important for businesses to protect against cyber attacks. Listen to our ThreatBite about this topic.
This blog covers what ChatGPT is and how its been utilised by criminals on the Dark Web. Have a read of our blog to find out more about how this AI tool is used.
This blog is about the geopolitical impact on cyber security including the affects of the Colonial Pipeline Attack and how this will impact the industry in the future.
This blog is about how to detect and respond to dark web threats, written by one of our consultants.
This blog summarises what Threat Intelligence is, the most common services and how our Threat Intelligence services here at DarkInvader can help. Have a listen to our podcast episode below.
This blog is about how hackers can destroy your business with the listed 5 common ways including social media and infrastructure. It also highlights how you can protect yourself from these attacks.
This blog is about the top emerging cyber threats for businesses in 2023 and how we can navigate this in 2023 listing 1 to 5 on the top emerging threats we are currently facing.
Businesses are now in need of active threat hunting more than ever before. Cyber attacks are on the rise and often start months before a significant incident occurs. Today we discuss why all companies should actively look for threats within their logs.
Part 3 of ThreatBites is here and we’re covering credential stuffing. In this blog post, we will discuss what credential stuffing is and how you can protect yourself from it.
Today we’re covering Technical Threats in the latest ThreatBite with the DarkInvader Research Team. This blog highlights what the shift in cyber attacks means for the technical threat landscape and what can be done.
Taking a look at your own safety online, one of our investigators discusses the dangers of social media presence, and how open-source intelligence techniques employed here at DarkInvader can reveal perhaps much more than you ever intended.
This blog summarises what threat intelligence is and why its crucial for businesses to invest in it for their own cyber security safety. Read this blog to learn about the importance of Threat Intelligence to businesses.
browse by tag
browse by category
browse by year
free trial
Try DarkInvader Pro free. No payment details required.
.jpeg)
