Sixteen pieces of security advice that will not die, paired with what is actually true, sourced from NIST, Verizon, Microsoft, and the FBI.
Most small businesses already own security features they never switched on. Here are the free changes with outsized returns, from required MFA to a payment callback rule, in the order we would do them.
Push bombing beats basic MFA by flooding phones with approval requests. Here is how it works, and how number matching and passkeys shut it down.
Passkeys are replacing passwords, and they cannot be phished or reused. What they are, where they live, and what happens if you lose the device.
Nearly every account you own resets through one inbox. Here is what happens when nobody can open it, and how to build a second door before anyone needs one.
The shared password spreadsheet is worse than it feels. A one week plan to move your whole company onto a password manager, objections and answers included.
Settled best practices for remote and hybrid work: device decisions, identity, home networks, the coffee shop question, physical security, and offboarding.
First in our 5-Minute Fix series. Text message login codes are the weakest kind of MFA. Here is how to switch to an authenticator app, and why it matters.
A practical before, during, and after checklist for keeping your phone, laptop, and accounts safe on vacation. No paranoia required.
Infostealer malware quietly copies saved passwords, session cookies, and autofill data off one laptop. Here is where it comes from and how to shut it out.