Smartphone Pattern Unlock Sucks

APIs expose backend logic and sensitive data directly; targeted API security testing uncovers broken authentication, excessive data exposure, and access control flaws that traditional pentests miss.

NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.

The first post in an anti-scraping series lays out five core principles: require authentication, enforce rate limits, lock down account creation, cap data volume, and return generic error messages.

Sectigo CTO Jason Soroko joins the Agent of Influence podcast to explain why MFA is the bare minimum of IAM, covering symmetric vs. asymmetric secrets and digital certificate best practices.

AF Group CISO Seth Edgar shares which security activities are making the greatest difference in his security program via the Agent of Influence cybersecurity podcast.

Shows how a CAPTCHA that can be solved once and replayed fails to stop brute force - a password was cracked on the 86th try - and lists checks like one-time use and session binding.