® 
Security Advisory September 8, 2026
Our digital defense is crumbling: why our CISOs are burning out
Our digital defense is crumbling, not because of attackers but because of the pressure on our CISOs. Five developments from research and practice.
Security Blog
Insights on cybersecurity trends, threat intelligence, compliance updates, and technical deep dives from the DEFION team.
Offensive Security September 3, 2026
Misconfigurations Remain the Open Door for Attackers
From our pentests and cloud security reviews: misconfigurations in Active Directory and Microsoft 365 are still the easiest way in for attackers.
Threat Intelligence August 20, 2026
The ghost skimmer: Magecart with blockchain storage and WebRTC delivery
DEFION analyzes a Magecart skimmer that stores its code in smart contracts on a public blockchain and delivers payloads via encrypted WebRTC, invisible to classic defenses.
Incident Response 26 June 2026
Residential proxies: how attackers hide inside legitimate internet traffic
DEFION and NCSC-NL warn of a growing trend: attackers increasingly route their traffic through residential proxy networks to evade detection. How they work, how to detect them, and how to reduce your risk.
Threat Intelligence 19 June 2026
Oracle PeopleSoft under active attack: what CVE-2026-35273 means and what to do now
CVE-2026-35273 is a CVSS 9.8 pre-authentication RCE in Oracle PeopleSoft PeopleTools, exploited as a zero-day for two weeks by ShinyHunters. Patching is step two. Here is what to check first.
Offensive Security 4 June 2025
Agentic AI Risks: When Management Interfaces Become an Attack Surface
Hundreds of publicly accessible AI agent dashboards found, sometimes protected only by a four-digit PIN. Research into agentic AI security risks by DEFION Offensive Security Specialist Jean de Cuba.
Threat Intelligence 19 May 2026
When OSINT Becomes Extortion: How Threat Actors Fabricate Breach Claims
Threat actors increasingly use OSINT, public metadata, and psychological pressure to fabricate convincing cyber breach claims without proving compromise. Learn how these extortion tactics work.
Incident Response 19 May 2026
Intern Account, 175 GB Exfiltrated: An Incident Response Case Study
A real-world IR case study: an attacker used an intern account with Domain Admin rights to compromise 26 systems, exfiltrate 175 GB of sensitive data, and nearly deploy ransomware across an educational institution.
Pentesting 16 April 2026
What is a Pentest? A Complete Guide for Organizations in 2026
A pentest (penetration test) is a controlled cyberattack on your own systems. Learn what a pentest is, when you need one, and what it costs.
Security Compliance 16 April 2026
NIS2 Explained: Everything Organizations Need to Know
NIS2 is the EU cybersecurity directive applying across Europe. Learn which sectors are covered, what obligations apply, and how to prepare your organization.
MDR 16 April 2026
What is MDR? Managed Detection & Response Explained
MDR is an outsourced 24/7 cybersecurity monitoring service. Learn what MDR is, how it works, and how it differs from SIEM, SOC, and MSSP.
Incident Response 16 April 2026
Cyber Incident: What to Do in the First 24 Hours
Step-by-step action plan for the first 24 hours of a cyber incident. Learn what to do, what to avoid, and when to notify regulators.