01
25 July 2026 · 17 min read
Active Directory tiering: Tier 0 in practice
How to split an environment into tiers, what really belongs to Tier 0, how to enforce the split technically and how to migrate without downtime.
Topic · 17 articles
Identity and Access
Active Directory, Entra ID, authentication, PKI and privileged access: attack paths, secure configuration, detection and retesting.
FIELD NOTES
TOPIC INDEX
Latest research
02
25 July 2026 · 17 min read
JWT security: kid, JWKS and key rotation
How JWT verification works and where it breaks: alg confusion, kid injection, JWKS handling, iss/aud validation, revocation, testing and detection.
03
10 July 2026 · 9 min read
FortiBleed FortiGate credential leak: response guide
Credentials linked to more than 70,000 FortiGate devices were leaked. FortiBleed is not a new zero-day: learn the confirmed facts and response steps.
04
9 July 2026 · 11 min read
Secrets management: Vault, KMS and secure rotation
Protect passwords, tokens and API keys with workload identity, Vault, KMS, short TTLs, rotation, audit trails and a tested leak-response process.
05
5 July 2026 · 10 min read
Privileged access management: a practical PAM guide
PAM reduces risks from administrator accounts, secrets and sessions. Learn how to deploy JIT access, session control and meaningful metrics.
06
3 July 2026 · 12 min read
Post-Quantum Cryptography: Why Migration Needs to Start Now
A quantum computer will break RSA and ECC, and the "collect now, decrypt later" attack is underway today. We discuss ML-KEM, ML-DSA, hybrid modes and migration plan.
07
25 June 2026 · 6 min read
Passkeys: why passwords are on the way out
Passkeys remove passwords and are phishing-resistant. We explain how they work, how they differ from MFA and how to start rolling them out.
08
12 June 2026 · 12 min read
MFA at work: how to roll it out so it works
MFA is the cheapest risk reduction we know — but only when deployed well. The differences between methods, a staged rollout plan and common traps.
09
3 May 2026 · 11 min read
A password manager for business: choose and deploy
Shared passwords in a spreadsheet are a ticking bomb. How a business password manager works, how to choose one and roll it out to teams.
10
29 April 2026 · 22 min read
SAML 2.0 penetration testing and signature wrapping
Technical SAML 2.0 testing for XML signatures, wrapping, Audience, Destination, Recipient, replay, RelayState and identity-provider key rotation.
11
27 April 2026 · 21 min read
TLS 1.3, mTLS and PKI security audit guide
Audit TLS 1.3, mutual TLS and PKI: protocol negotiation, identity validation, certificate paths, revocation, 0-RTT and key rotation.
12
23 April 2026 · 10 min read
Identity theft: how to protect yourself and respond
Stolen personal data lets criminals take out loans or register a company in your name. How identity theft happens and how to protect yourself.
13
15 April 2026 · 9 min read
Strong passwords: busting the myths, showing what works
Change your password every 30 days? Invent complex character strings? We explain which password rules are outdated myths and what really protects your accounts.
14
14 April 2026 · 21 min read
Microsoft Entra ID penetration testing guide
Assess Entra ID tokens, consent, roles, Conditional Access, PIM, service principals, workload identities, hybrid trust and cloud identity detection.
15
13 April 2026 · 20 min read
NTLM relay defence: SMB, LDAP and EPA
A technical model for NTLM relay to SMB, LDAP and HTTP, with safe assessment, signing, channel binding, EPA, detection and NTLM migration guidance.
16
12 April 2026 · 19 min read
Kerberos delegation and RBCD penetration testing guide
Understand S4U2self, S4U2proxy, KCD and RBCD, then safely assess delegation ACLs, SPNs, tickets, detection and lateral-movement exposure.
17
11 April 2026 · 20 min read
AD CS ESC attacks: certificate security assessment
Audit AD CS, certificate templates and ESC1–ESC15 paths. Understand PKINIT, strong mapping, safe validation, detection and enterprise PKI hardening.
BR / NEXT STEP
Want to prepare your team for these threats?
We turn current threats into role-based training, safe exercises and a clear reporting path. The free Academy remains available for self-directed learning.
NDA · clear scope · direct communication