Practical defense
against AI-era attacks
Attackers are using AI to move faster. We break down real incidents, show how to defend with AI agents, and lay out the data-handling procedures that stop a breach from spreading.
Latest incidents and guides
Business Email Compromise Response: The First 24 Hours
Call the bank before you investigate, find out whose mailbox leaked the thread, then remove the rules, grants and sessions a password reset leaves behind.
Data Breach Notification Laws by State: Which Deadline Binds
A four-step procedure for a breach that touches several states: test the data and the incident, map residents, build one calendar with a start event and due date per clock, then add sector rules.
Claroc says 35,578 Grok-built apps were open to anyone with the link
Claroc's count of Grok apps open with no sign-in, why a "secret link" is findable, and how a US company finds and locks down apps its staff published.
Vates says attackers are exploiting a Xen Orchestra login bypass that grants Admin and can lead to root on XCP-ng hosts
Vates says a threat actor is exploiting an authentication bypass in Xen Orchestra, and that successful unauthenticated access leaves no log entry.
HIPAA breach notification: from the discovery date to the HHS report
The clock starts when your workforce could have known, not when forensics ends. A four-step procedure for the discovery date, the no-notice decision, the notices and the record OCR will ask for.
Ransomware Response Playbook: Decisions for the First 72 Hours
The first 72 hours of a ransomware attack are a chain of decisions that each close an option. Who decides, in what order, and what a decision log must record.
Browse by topic
Guides and checklists
Procedures, checklists and fill-in plans for handling data and running an incident.
All guides- Business Email Compromise Response: The First 24 HoursHow-to
- Data Breach Notification Laws by State: Which Deadline BindsHow-to
- HIPAA breach notification: from the discovery date to the HHS reportHow-to
- Ransomware Response Playbook: Decisions for the First 72 HoursHow-to
- New York data breach notification law: residents within thirty days, three state agencies and, for DFS licensees, a DFS report within 72 hoursOverview
- California data breach notification law: notice to residents within 30 calendar days, the Attorney General copy and what triggers themOverview
Defense first
We explain how an attack works so you can stop it. We do not publish working exploits.
Facts checked against their sources
Claims are checked against their sources before publication. Versions, prices and other values that change are re-checked afterward.
Responsible disclosure
Found a flaw in something we cover? Write to the editors at contact@cybersecurity.guru.