Cybersecurity Blog
In 2019, Capital One discovered that 106 million customer records had been exposed through a single misconfigured AWS firewall rule. Cloud providers like AWS and Azure are excellent at securing the infrastructure they operate. This includes the physical data centers, the hardware, and the underlying…
We recently logged in to Google Analytics and noticed something that didn’t belong. A domain we’d never heard of (trafficheap.cc) showed up in our page list like it was part of our website. As a cybersecurity company, we went on high alert immediately. Our first…
You already know cybersecurity matters. You’ve read the articles. You’ve probably had the conversation with your IT person or your insurance agent at least once. And you may have even opened a tab with some security checklist at some point, fully intending to get back…
There’s a good chance your organization has a password policy that looks something like this: passwords must be at least eight characters, contain uppercase and lowercase letters, a number, and a special character, and be changed every 90 days. There’s also a reasonable chance your…
Most people imagine cybersecurity threats arriving through the internet, like a phishing email, a brute-forced password, or ransomware from a malicious link. But some of the most direct paths into an organization’s systems don’t require any hacking at all. They just require walking through the…
During an internal penetration test for a municipality, our testers discovered something the client almost certainly didn’t know was accessible: a section of the network containing concealed carry permit records. This included personal information and sensitive law enforcement data. It was the kind of records…
Most organizations that reach out to MainNerve about a penetration test have been thinking about it for a while. Sometimes months. They know they need one because an insurance carrier asked for it, a client required it, or they’ve been reading about breaches in their…
If you’ve worked with MainNerve on a risk assessment, there’s a good chance RealCISO has come up in that conversation. We offer it to clients as a way to take ownership of their own security posture. It’s a platform that guides organizations through structured risk…
Price is almost always the last question in a penetration testing conversation, and it’s usually the one that makes people the most uncomfortable, on both sides of the table. Clients don’t want to seem like they’re shopping on price alone. Vendors don’t always want to…
If you’ve ever received a penetration test report and felt like the severity ratings didn’t quite match your intuition about what was serious, you’re not imagining things. Severity ratings are one of the most consequential parts of any pen test report. Organizations use them to…
If you’re an MSP, an IT consultant, a VAR, or any kind of technology services provider, there’s a good chance your clients are starting to ask about penetration testing. Maybe a cyber insurance carrier required it on the renewal application. Maybe a client received a…
There’s a moment in almost every scoping conversation where we ask something like, “Do you have a penetration test budget in mind?” And there’s a predictable pause on the other end. We understand why. The assumption most people make is that asking for a budget…
