adminThinking on cybersecurity, compliance, and managed defence - from the CyberCheck team.
admin
Cloud detection and response tools, commonly abbreviated CDR, have emerged as a distinct cloud security category. Organizations evaluating these tools alongside existing cloud security posture management and workload protection tools often lack clarity on exactly what additional capability CDR provides. Why CDR Addresses a Distinct Security Need From CSPM and CWPP Cloud security posture management … Read more
Organizations investing heavily in digital security testing sometimes overlook physical penetration testing entirely. That is a mistake: physical security gaps can hand attackers a considerably easier path to sensitive systems and data than any sophisticated digital attack would require. Why Physical Security Gaps Bypass Digital Security Investment Entirely An attacker who gains unauthorized physical access … Read more
Kubernetes admission controllers give teams a powerful mechanism for enforcing security and operational policy before resources are ever created in a cluster. Yet many organizations underuse this capability. They rely instead on after-the-fact detection and remediation for violations that admission control could have prevented entirely. What Admission Controllers Do Admission controllers intercept requests to the … Read more
Tabletop exercises are structured, discussion-based simulations that walk a team through a hypothetical security incident. They deliver real incident response practice at a fraction of the cost and disruption of a full technical simulation, yet most organizations still underuse them relative to their actual value. What a Tabletop Exercise Involves A tabletop exercise gathers the … Read more
Purple teaming brings offensive red team and defensive blue team security professionals together into direct, real-time collaboration, instead of leaving them to operate in isolation from each other. It has emerged as a valuable evolution beyond traditional red team engagements, which operate largely separately from the defensive teams they are testing. Why Traditional Red Team … Read more
Organizations pursuing SOC 2 compliance encounter both Type I and Type II report options. Many organizations new to SOC 2 do not fully understand the meaningful difference between the two – a distinction that matters considerably for choosing the right compliance path and setting realistic customer expectations. What a SOC 2 Type I Report Covers … Read more
Cloud workload protection platforms, commonly abbreviated CWPP, have become a standard component of mature cloud security programs, yet organizations evaluating these tools for the first time often lack clarity on exactly what protection CWPP tools provide beyond generic marketing descriptions. What Cloud Workloads Need Protecting Cloud workloads – virtual machines, containers, serverless functions – represent … Read more
Cross-site request forgery, commonly abbreviated CSRF, remains a persistent web application vulnerability, despite being a well-documented, long-understood attack technique. Understanding why CSRF continues succeeding against real applications helps explain why this vulnerability class still deserves serious security attention in 2026. How CSRF Attacks Work CSRF attacks exploit the fact that browsers automatically include a user’s … Read more
Kubernetes clusters operate with default-allow network behavior out of the box. Pods can communicate freely with each other unless network policies are explicitly configured to restrict that communication – a default that catches many organizations by surprise once they understand its real security implications. Why Kubernetes Defaults to Open Pod-to-Pod Communication Kubernetes defaults to allowing … Read more
Threat modeling, the systematic practice of identifying potential security threats to a system before building or deploying it, often feels intimidating to smaller teams without dedicated security expertise, yet a practical, simplified threat modeling approach remains valuable and achievable even for teams without extensive formal security training. Why Small Teams Skip Threat Modeling Despite Its … Read more