Blog.

Zero Trust is the buzzword every vendor sells as a product. But it is a strategy, not a purchase - and for most SMEs the tools are already paid for, sitting in the M365 tenant. What it really is, and how to start with zero spend using identity and Conditional Access.

Many of the breaches you read about do not start with a genius hacker, but with a small program that runs for half a minute and walks off with everything the browser remembered. What an infostealer is, what it steals and how to defend.

The page says "verify you are human": press Win+R, paste, Enter. It is one of the most widespread attack techniques of 2026 - and it does not exploit your computer, it exploits you.

The default is "put everything in the cloud". But for a small company it is not always the right call: between egress costs, data sovereignty and lock-in, sometimes keeping it in-house wins. An honest framework for deciding.

NIS2 is in force and Italy has transposed it: concrete obligations, personal management liability, fines up to 2% of turnover. Who is in scope, what the directive really requires, and how to tackle it without being overwhelmed.

You do not need to be a genius. You need a method: pick a bug class, understand a system more deeply than whoever wrote it, automate, and report well. How you actually become a vulnerability researcher.

Defenders drown in alerts, almost all false positives. Deception flips the game: it plants lures only an attacker can touch, so every interaction is a true positive. How it works, from honeypots to canary tokens.

Finding the bug is the easy part. Then coordinated disclosure begins: the contact that does not exist, the silence, embargoes, the CVE, the quiet fix. How it really works, from someone who has done it across dozens of projects.

XDR is one of the most abused acronyms in security marketing. Behind the hype sits a precise architecture: how telemetry becomes detection, detection becomes response, and separate systems become one platform. Taken apart layer by layer, by someone who built one.

Aggregating threat feeds is easy: in an afternoon you swallow tens of thousands. The problem is not quantity, it is deciding what NOT to show. Severity is not priority - and how to make threat intelligence actionable, from theory to a relevance engine.

You set an X-API-Key header and trust it only goes to your API. But what happens when the response is a redirect? How to check if you are exposed.

Building your own security stack promises control and no license fees. But the real cost is not the software: it is time, maintenance and the risk of being on your own. An honest framework for deciding.