.svg)
CybersecurityIncidentIncident ResponseAI
How to Use AI for Incident Response: Lessons Learned From a Real Engagement
We recently used frontier AI throughout an incident response engagement, from the first log query to the final incident report. This is how it went,...
Railway Security Incident (October 2026): What to Do, and What SOC 2, ISO 27001, GDPR and HIPAA Require
On October 21, 2026, Railway disclosed that an unauthorized third party may have accessed the encrypted environment variables of its customers and,...
PHP2Shell (CVE-2026-109618, CVE-2026-109619): What to Do, and When It Becomes an Incident
PHP2Shell is two critical flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, that allow remote code execution without a login on PHP web...
ISO 27001 A.5.24: Information Security Incident Management Planning and Preparation
ISO 27001 A.5.24 requires an organization to plan and prepare for security incidents before they happen: define the roles, the response process, the...
SOC 2 CC7.5: Recovering From Identified Security Incidents
SOC 2 CC7.5 requires a company to identify, develop, and implement the activities that recover the environment after a security incident, and to...
SOC 2 CC7.4: Responding to Security Incidents
SOC 2 CC7.4 requires a company to respond to security incidents through a defined incident-response program that understands, contains, remediates,...
The Canadian Ransomware Paradox: Why Two Surveys Disagree on Payment
Two of the most-cited Canadian ransomware statistics flatly contradict each other.
Statistics Canada, reporting on 2023 data released in October...
SOC 2 Ticketing & SLAs: Vulnerability Patching & Incident Response
TL;DR: SOC 2 compliance requires a formal, trackable process for all security-relevant activities. Under the Trust Services Criteria, this means...