Part 3: The CMMC Pause Does Not Pause False Claims Act Risk   In Parts 1 and 2 of this series, we explained that the Department paused the expansion of Phase II certification requirements but...

I’ve spent a large part of my career around penetration testing, and one thing has always been true: there is never enough time to test everything as deeply as we would like. A good pentester can do...

Part 2: What the CMMC Pause Does Not Change In Part 1 of this series, we explained what the Department of War paused on July 13, 2026 and why organizations should not interpret the announcement as...

Part 1: CMMC Phase II Is Paused—But the Program Is Not The Department’s July 13, 2026 announcement that it was suspending Phase II of the Cybersecurity Maturity Model Certification (CMMC) program...

Why validating your people, processes, and technology is the next evolution of cybersecurity.   Organizations have never invested more in cybersecurity. Security Operations Centers (SOCs),...

SCPTP: A Better Way to Run Purple Team Exercises Most purple team engagements still run on spreadsheets, screenshots, and a report written after the fact. SCPTP replaces that with a real-time,...

For many companies, especially manufacturers, fabricators and/or specialty suppliers, the expanding radius of the efforts to secure the U.S. defense industrial base will reach their doorstep this...

What started as conversations on the drive home from cybersecurity conferences eventually became something much bigger. For years, Ryan and Allie attended events like DerbyCon, GrrCON, and THOTCON...

Introduction: The Question Most Security Programs Can’t Answer Most organizations can tell you: What security tools they own What vulnerabilities exist in their environment What controls are...

  Most security programs spend millions on tools and people, then rely on dashboards and assumptions to tell them everything is working. Purple team exercises close that loop. A purple team...