Why Annual VAPT Is Not Enough in 2026
A short reading note on testing cadence, with the original article and its publication date kept in view.
Open the reading noteSecureline / Research
Keep asking
better questions.
A small, considered reading desk for the decisions behind security work.
The research desk
Find a useful
next question.
Reading notes and work in progress. The status stays attached to the work.
The VPN Is the Attack Surface: Perimeter Trust vs. NIST SP 800-207 Zero Trust
Edge-device exploitation has turned 'authenticate once, then trust the network' into the weakest link; this post covers what SP 800-207 actually specifies and where it still does not save you.
Read the articleHashes Don't Survive Contact: Signature AV and Static IOCs vs. EDR and Behavioural Detection
Matching artefacts the attacker controls loses to living-off-the-land tradecraft and in-memory implants, but behavioural detection has its own blind spots, starting with appliances that cannot run an agent.
Read the articleSeverity Is Not Likelihood: CVSS-Only Triage vs. EPSS, KEV and Context
Exploitation is now the top breach entry point while KEV remediation is slipping, so the question is no longer how severe a CVE is but which few you can fix first.
Read the articlePasswords plus SMS codes versus passkeys: what phishing resistance actually changes
Why a valid password and a valid six-digit code can both be relayed, how WebAuthn binds the proof to the real origin, and what a passkey still cannot protect.
Read the articleWhy a WAF cannot see Broken Object Level Authorization
The WAF-plus-Web-Top-10 model inspects requests for malicious shapes; the OWASP API Security Top 10 is dominated by requests that are perfectly well-formed and simply not yours to make.
Read the articleFrom end-of-pipeline scanning to supply-chain controls: what xz and Shai-Hulud changed
Scanning the release candidate assumes the artifact is the one you reviewed and the dependencies are inert; two real incidents show why SBOMs, provenance and a hardened toolchain have to sit earlier in the flow.
Read the articleFrom RSA/ECC-only to post-quantum ready: what crypto-agility actually requires
Harvest-now-decrypt-later makes key establishment a present-day problem, and NIST's August 2024 standards only help if your systems can swap algorithms without a rewrite.
Read the articleApplication pentesting vs LLM red teaming: when the input is the exploit and the model is the confused deputy
LLM applications put instructions and data in the same channel, so the classic test plan still applies downstream of the model but cannot be the whole engagement.
Read the articleFrom alert-by-alert SIEM rules to detection engineering and detection-as-code
Attackers now hand off access in seconds and dwell for months in places EDR does not see, so a pile of vendor rules with 90 days of logs is not a detection programme.
Read the articleBackup-and-Restore Is Not a Recovery Plan Anymore: Designing Against Recovery Denial
Mandiant's M-Trends 2026 describes ransomware operators attacking identity, hypervisors and backup tooling before they encrypt anything, which breaks the assumptions classic disaster recovery was built on.
Read the articleAfter the Login: Standing Privilege, Stolen Tokens and Identity-First Security
MFA at the front door says little about a session token in an attacker's hands or an OAuth integration that never prompts anyone; here is how just-in-time access, consent control and identity threat detection change that.
Read the articleFrom Audit Season to Evidence Pipelines: Continuous Control Monitoring Done Honestly
NIST SP 800-137, the AICPA's treatment of tool-produced evidence, and OSCAL describe a shift from assembling proof once a year to producing it continuously, and also where that shift can fail.
Read the articleFrom findings to decisions
An unpublished working outline for connecting a finding to context, ownership, a decision and evidence of closure.
Explore the outlineMicrosoft Digital Defense Report 2026
Microsoft's annual threat report, published 1 October 2026: AI compressing attack timelines, identity as the control plane, and a shift from patching to exposure management. Summarised here with a link to the original.
Read the summaryENISA Threat Landscape 2026
The EU cybersecurity agency's annual assessment of 2025, published 22 September 2026: dependencies, supply chains and cloud as the amplifiers of large-scale incidents. Summarised here with a link to the original.
Read the summaryNo results
A different question?
No items match this combination of search and format.
Beyond this desk / Primary sources