Preparing for a penetration test: a 10-point checklist for SMEs
What to do before your first pentest. From defining scope to managing access, a practical guide to solidify your preparation.
read more →Notes on software and security
Expert guides and current analysis on software development, product, integration and cyber security.
Backups aren’t enough: the 3-2-1 rule and disaster recovery
Real protection against data loss requires more than a regular backup. An untested backup is no backup.
Off-the-shelf or custom software? Making the right call
There is no single answer for every business. The criteria to weigh when deciding.
An introduction to Zero Trust architecture
The “trust everyone inside” era is over. Why does modern security verify every access?
Technical SEO: fundamentals for B2B technology sites
To be visible you must first be findable. How do search engines understand your site?
An API-first approach to system integration
Disconnected systems create data silos. How should modern integration be designed?
Why API security is a problem of its own: the OWASP API Security Top 10 (2023)
APIs are the backbone of modern software, and also its most attacked layer. In 2024, 37% of organizations suffered an API breach. Inside OWASP API Security Top 10.
Should employees reach company data from their own phones? BYOD, MDM and MAM
Personal phones touching company data is not the problem; unmanaged access is. What separates MDM from MAM, the limits of remote wipe, and off-boarding.
Who is responsible for cloud security? Misconfiguration and the shared responsibility model
Moving to the cloud does not transfer security responsibility to your provider. Where the shared responsibility model ends, your job begins. Here is the line.
DDoS attacks: what they are and how to protect your business
A DDoS attack floods your site with fake traffic until real users can't reach it. Records hit 31.4 Tbps in 2025. Here's how they work and how to defend.
EDR vs antivirus: is traditional antivirus still enough?
Antivirus catches known malware by matching signatures, but 79% of 2024 attacks used no malware file at all. Here is what EDR does differently and why you need it.
Is someone sending fake email in your name? Protect your domain with SPF, DKIM and DMARC
Anyone can send email that shows your domain in the From line. Here is how SPF, DKIM and DMARC stop domain spoofing, and the safe order to set the three records up.
Why end-of-support software is a real risk, and what to do after Windows 10
Vulnerabilities keep appearing in end-of-life software, but patches stop. Windows 10, Exchange and SQL Server 2016: inventory, ESU cost and a migration plan.
Why hardcoding API keys and passwords is dangerous: a guide to secrets management
Writing an API key, password or token into your source code makes a leak inevitable. In 2025, 29 million secrets were exposed on public GitHub. Here is the fix.
HTTPS and SSL/TLS certificates: why lifetimes are dropping to 47 days
HTTPS encrypts your traffic and proves your server's identity. Certificate lifetimes drop to 47 days by 2029, ending manual renewal. Here is what to know.
You have just found an attack: what to do in the first 24 hours
The first day after you spot an attack decides how bad it gets. How to contain it without destroying evidence, who to call, and when the legal clock starts.
What an ISO 27001 certificate actually proves, and whether you need one
An ISO 27001 certificate proves you run an information security management system in a declared scope, not that you are secure. What the 93 controls and audits show.
You collect logs, but is anyone reading them? SIEM, MDR and 24/7 monitoring
Collecting logs is not detection. Which logs actually matter, why 90 days of retention is not enough, and whether you should run monitoring in-house or buy MDR.
Multi-factor authentication: which second factor is actually secure?
MFA blocks more than 99% of automated account attacks, but not all MFA is equal. Here is why SMS codes are the weakest link and which second factor resists phishing.
OWASP Top 10 2025: the ten flaws most likely to break your web app
OWASP has updated its Top 10 after four years. What is the number one web risk in 2025, what changed, and how should your company actually use the list?
What is a passkey, and will it really replace passwords? A passwordless guide for businesses
A passkey swaps your password for a cryptographic key on your device. Here is how it works, why it resists phishing, and where your business should start.
Patch management: how delaying updates puts your company at risk
Exploiting unpatched flaws is now attackers' top way in, past stolen passwords. WannaCry's fix had shipped two months before the attack. Which do you patch first?
Phishing Protection for SMBs: A Practical Guide
Why phishing hits small and mid-sized businesses so often, and the low-cost steps you can take today to protect your company and its accounts.
Ransomware: how to protect your company and should you pay the ransom?
Ransomware no longer just encrypts your files, it steals them first. Here is how the attack works, how your company can defend against it, and whether paying helps.
Your team is pasting company data into ChatGPT: how to manage the Shadow AI risk
Your team is pasting company data into tools like ChatGPT. Why the Shadow AI risk is so widespread, and how to build a safe, compliant usage policy today.
Software supply chain security: how your dependencies put you at risk
Every open source library you install is a door into your systems. Here is how software supply chain attacks really work and how to defend your company.
Who owns your software's source code? Contracts, rights transfer and escrow
Whoever writes the code owns it by default. Turkish law requires a written, itemised transfer of rights. What your contract, handover list and escrow must cover.
Vulnerability scan or penetration test? What each one actually finds
A scanner lists known vulnerabilities. A pentest proves how far someone can get with them. Why PCI DSS and Turkish banking rules require both, separately.
Stay in the loop
Once a month, only value-adding content. No spam, unsubscribe anytime.