Semiconductor supply chains: the risk a supplier register can hide
A supplier's headquarters does not reveal every equipment dependency. Map support, replacement paths and alternatives before an urgent migration.
Blog
Guías prácticas sobre pentesting, investigación de vulnerabilidades y herramientas de seguridad con IA.
Los artículos se publican en inglés y portugués.
Investigación
124 publicaciones
Technical team continuity: who can operate when the specialist is away?
Use the PERM announcement as a prompt to review dependence on individuals, without inferring risk from a worker's nationality.
GhostAction on GitHub Actions: protecting secrets and reviewing workflows
An automation with a security label can still carry dangerous behavior. Our analysis proposes authorized tests for workflow changes, secret exposure and runner boundaries.
Cybersecurity Startups: The Application Security Opportunity
NFX sees an opening for security startups as software changes. Our analysis turns that thesis into a practical evidence checklist for evaluating application security, AI integrations and pentest providers.
The AI “Super Bubble” Warning Is a Filter, Not a Funeral
Two of China's most respected hedge fund managers called the global AI rally a super bubble. Here is why that warning is actually good news for security and what a correction would do to the companies running on narrative versus the ones solving real problems.
Novo Nordisk Breach: How a Leaked GitHub Token Exposed the Exact Ozempic Formula
FulcrumSec claims 1.3 TB stolen from Novo Nordisk, including source code, the exact Ozempic formula and clinical trial data on roughly 11,500 patients. Initial access came from one GitHub token, two months of dwell time, and a lot of lessons every engineering org should take from it.
iFood “Mega Leak” Alert: What This Kind of Case Teaches Every Business About Data Security
A threat actor claims to hold a massive iFood customer database and is demanding payment to suppress it. The pay-or-leak model, why CPF and contact data is dangerous, and concrete steps for businesses and customers.
Cloud Security in 2026: Misconfigurations, Hybrid Sprawl and New Frontlines
Misconfigurations still dominate cloud incidents. Hybrid sprawl, IAM as a frontline, and why checklist security misses real attack paths. Plus how cloud-aware pentesting closes the gap.
Inside ShinyHunters: How Modern Extortion Groups Operate, and How to Defend Against Them
Five phases from access to leak, why exfiltration-only extortion scales, what makes detection hard, and concrete controls , from cloud permissions to continuous pentesting.