Cybersecurity Blog
Six months into 2026, the breach numbers were already worse than last year. And last year was a record from the year before. According to the Identity Theft Resource Center (ITRC), a nonprofit that tracks publicly reported breaches and assists victims of identity theft, U.S.…
Most small businesses run antivirus software and have a firewall in place. But there’s a good chance someone along the way let you walk away thinking those two things had you covered. And if you’ve had a nagging feeling they might have oversold it a…
If someone asked you right now what the most common way is that small businesses get breached, what would you say? A lot of people guess ransomware, or maybe a sophisticated hack of some kind. The answer is usually a lot more ordinary than that,…
In 2019, Capital One discovered that 106 million customer records had been exposed through a single misconfigured AWS firewall rule. Cloud providers like AWS and Azure are excellent at securing the infrastructure they operate. This includes the physical data centers, the hardware, and the underlying…
We recently logged in to Google Analytics and noticed something that didn’t belong. A domain we’d never heard of (trafficheap.cc) showed up in our page list like it was part of our website. As a cybersecurity company, we went on high alert immediately. Our first…
You already know cybersecurity matters. You’ve read the articles. You’ve probably had the conversation with your IT person or your insurance agent at least once. And you may have even opened a tab with some security checklist at some point, fully intending to get back…
There’s a good chance your organization has a password policy that looks something like this: passwords must be at least eight characters, contain uppercase and lowercase letters, a number, and a special character, and be changed every 90 days. There’s also a reasonable chance your…
Most people imagine cybersecurity threats arriving through the internet, like a phishing email, a brute-forced password, or ransomware from a malicious link. But some of the most direct paths into an organization’s systems don’t require any hacking at all. They just require walking through the…
During an internal penetration test for a municipality, our testers discovered something the client almost certainly didn’t know was accessible: a section of the network containing concealed carry permit records. This included personal information and sensitive law enforcement data. It was the kind of records…
Most organizations that reach out to MainNerve about a penetration test have been thinking about it for a while. Sometimes months. They know they need one because an insurance carrier asked for it, a client required it, or they’ve been reading about breaches in their…
If you’ve worked with MainNerve on a risk assessment, there’s a good chance RealCISO has come up in that conversation. We offer it to clients as a way to take ownership of their own security posture. It’s a platform that guides organizations through structured risk…
Price is almost always the last question in a penetration testing conversation, and it’s usually the one that makes people the most uncomfortable, on both sides of the table. Clients don’t want to seem like they’re shopping on price alone. Vendors don’t always want to…
