Topics

Every domain account sees more than it should. Attackers use that to escalate privileges and gain persistence. Free tools such as NetExec make that visible; tiering, hardened authentication and traps such as honeypots help against it.

Language models and agents attack and get attacked. That covers AI-assisted vulnerability research and vibe hacking as much as securing MCP servers and RAG access to company data.

In AWS, Azure and Entra ID, identity decides, not the network. Free audit tools show who is allowed to do what and where the configuration is off.

Attackers work with built-in tools such as PowerShell, with malware and with whatever OSINT reveals about a company. Anyone who audits their own environment with free tools and plants honeypots or Canarytokens notices intrusions early. Some security myths do not survive that test.

Insecure defaults and misconfigurations are an entry point into Microsoft 365 and Entra ID. A secure baseline configuration and the Defender products protect against that; afterwards the cloud logs show what happened.

How web applications and APIs get attacked is written down in the OWASP Top 10 and its counterpart for APIs. Dynamic tests find the gaps in production; secure development avoids many of them from the start.

PowerShell serves both sides: attackers use it after the break-in, forensics reads its logs. Hardening clients and servers and separating administration through tiering and privileged access workstations limits the damage.