Research

What we see in the field,
written down

Anonymised breakdowns of the pretexts we encounter in engagements, and the procedures that defeat them. No gating, no lead capture in front of anything useful.

All categoriesSocial engineeringHuman riskDeepfakeVishingVerificationOSINTExposurePsychologyTrainingProgram design
Social engineeringHuman risk

Why social engineering beats your security stack

You can buy every control on the market and still lose to a polite phone call. Here is why the human layer keeps deciding breaches, and what actually changes the outcome.20268 min read
DeepfakeVishing

AI voice cloning attacks: how they work and how to stop them

Cloning a voice now takes seconds of audio and costs nothing. A practical breakdown of how these calls are built and the verification habits that defeat them.20267 min readDeepfakeVerification

Someone joined your video call as your CFO. Now what?

Live face replacement is good enough to survive a short meeting. A verification protocol your finance and leadership teams can actually run under pressure.20266 min readOSINTExposure

OSINT: how attackers research your company before they touch it

Reconnaissance is the longest phase of a social engineering attack and the only one you can disrupt for free. Here is what gets collected, and from where.20267 min readPsychologyTraining

The six psychological levers every social engineer pulls

Manipulation is not improvised. It follows a small, stable set of levers. Learn to feel them being pulled and the attack loses most of its power.20268 min readHuman riskProgram design

Security awareness training is broken. Human risk management is what replaces it.

Annual modules and click-rate dashboards produce compliance, not resilience. What a modern human risk program measures instead, and why boards are starting to ask.20267 min read