Business email compromise: verify bank changes before paying
A convincing invoice can arrive from a real but compromised mailbox. Protect the payment decision with independent verification of changes to the beneficiary or account details.
Phishing beyond the email filter: verify the request, not the badge
An email that passes technical checks can still ask you to do something harmful. A trusted sender’s account may be compromised, and a plausible message may lead to an unsafe action.
TLS checks: protect the connection all the way to the service
A valid certificate at the public edge is only part of a secure connection. Review protocol settings, hostname validation, internal hops, and the origin that ultimately handles the request.
Cloud IAM escalation: when a small permission becomes admin access
A role can gain power indirectly by changing another identity, passing a privileged role, or altering a workload. Review what permissions make possible together, not only their individual names.
Public cloud storage: find exposed files and close access safely
A storage service can encrypt its data and still make it public. Review the paths to the files: identities, bucket or container policies, shared links, and any public delivery layer.
API business-logic abuse: valid requests can still cause harm
An API request can be correctly formatted and still misuse a workflow. Review the business outcome, especially repeated actions, ownership checks, and limits that span several requests.
Broken access control: can one user reach another user’s data?
Being signed in should not give a person access to every record. The server must check permission for the specific object and action on every request.
Stolen session cookies: why a password reset may not end access
A session cookie can let a browser continue using an account after sign-in. If a session is stolen, changing the password may not revoke every active session or connected application.
MFA push fatigue: what to do with unexpected approval requests
Repeated sign-in prompts can pressure someone into approving access they did not start. Treat an unexpected approval request as a signal to stop, verify, and investigate.
Stolen passwords: stop credential stuffing across every login route
An attacker can reuse a stolen password through more than the main sign-in page. Review mobile APIs, legacy access, and recovery routes alongside the login form.