PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

ABP (Always Be Prepared) For Social Engineering Threats

bugcrowd.com | blog | #pentesting | #security-training | #phishing | #social-engineering | #bugcrowd | #socialproof-security
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Social engineering ranked #1 threat in ISACA's 2021 survey. Bugcrowd partners with SocialProof Security to resell prevention training, protocol reviews, and social engineering pen tests.
Published
Collected

Related coverage

blog · bugcrowd.com
Agentic vs human offensive security testing: Where AI actually earns its keep
Bugcrowd's CTO and offensive security lead break down where agentic security testing earns trust, where human judgment still wins, and how to roll it out without burning engineering's confidence.
blog · bugcrowd.com
AI lectures with Dr. Brumley Part 2 | The anatomy of a modern AI system
David Brumley maps the anatomy of modern AI systems for CISOs: four training stages (pretraining, SFT, RLHF/DPO, adapters) each an attack surface, plus the context window's lack of enforcement.
blog · bugcrowd.com
AI lectures with Dr. Brumley Part 1 | Defining AI for CISOs
Bugcrowd's Dr. David Brumley opens his AI lecture series for CISOs by breaking 'AI' into seven distinct mechanisms — from machine learning to symbolic reasoning — each with its own attack surface.
blog · netspi.com
Adding Web Content Filter Exceptions for Phishing Success
Describes how attackers can submit phishing domains to web content filter categorization services so corporate filters whitelist the sites, improving success rates in phishing engagements.
blog · netspi.com
All You Need Is One – A ClickOnce Love Story
ClickOnce deployment, built for easy Windows app installs, doubles as a phishing vector: one click can grant a malicious payload temporary admin privileges, controlled by registry trust settings.
blog · netspi.com
Malicious MobileConfigs
A phishing email delivering a .mobileconfig profile can reroute iOS devices through an attacker proxy, install malicious MDM, and capture HTTP/HTTPS traffic or domain credentials via Burp.
Back