BIA and Recovery Limits: Make RTO and RPO Business Decisions
Turn maximum tolerable downtime, recovery time, and data-loss limits into owner-approved business decisions that teams can exercise and improve.
Read the article
Skip to content
Research and guidance
Security insights
Vulnerability research and practical observations from the work of testing, protecting, and improving real environments.
Least Privilege Begins With Business Functions, Not Groups
Directory membership shows assigned access. It does not prove that the access is required for a person's position and allocated functions.
Read the articleFrom Point-in-Time Assessment to Continuous Assurance
Map the business, establish the observed baseline, define the target, verify remediation, and monitor for unauthorized drift.
Read the articleWhy a Technical Baseline Cannot Prove Your Environment Is Secure
An audit records what exists. A defensible security conclusion requires approved business functions, ownership, access, data flow, and recovery context.
Read the articleCaremark, Cyber Risk, and a Defensible Oversight System
Build the business-linked reporting, material-risk register, escalation, remediation, acceptance, and recurring review evidence that supports executive due care.
Read the articlei-GEN opLYNX Central Authentication Bypass
CVE-2012-4688. Client-side authentication logic allowed access when JavaScript was disabled.
Read the disclosureAxxonSoft Axxon Next Directory Traversal
CVE-2018-7467. A directory traversal issue in the AxxonSoft client web interface.
Read the disclosureManaged Vulnerability Scanning as a Service
Why recurring authenticated discovery, reporting, remediation, and validation are foundational to a durable security program.
Read the article