Insights
Field notes from the trenches.
Engagement post-mortems, vulnerability deep-dives, and lessons learned from defending casinos, exchanges, and banks. No marketing fluff.
Leaked Stripe keys: what to check in 24 hours
659 merchants' live Stripe secret keys leaked, exposing 688,000 customer records — not a Stripe breach, but secrets pulled from merchants' own code and logs. What to verify now.
Read the write-up →
Cloud Hardening for an Online Casino: What Comes First
Server, network, identity, application, cloud config — five hardening categories and only so many change windows. The priority order that actually cuts risk fastest for a casino.
Read →
How often should an online casino run a vulnerability assessment?
Quarterly is the compliance floor, not the answer. The cadence framework for online casinos — regulatory minimums, the AnySec baseline, and the five risk-based triggers that should move a scan off-cycle.
Read →
Scoping an external vulnerability assessment for a casino
What an external vulnerability assessment actually scans on an online casino perimeter, what it structurally cannot prove, and where PCI-DSS ASV scope ends.
Read →
24/7 SOC Coverage Models for a Crypto Exchange
Co-managed, follow-the-sun, or an in-house night shift — how to pick the staffing model that actually delivers 24/7 SOC coverage for a crypto exchange.
Read →
Scoping a penetration test for a crypto exchange
How to scope a penetration test for a crypto exchange: wallet and custody assets, RoE for live production funds, tiers, and what the report covers.
Read →
Black-box vs grey-box vs white-box pentest
Black-box, grey-box, and white-box penetration testing give a tester different starting knowledge — here's which to request for an online casino, and why.
Read →
CVE-2026-72898: admin takeover via Metabase
CVE-2026-72898 is a CVSS 10.0 unauthenticated Metabase SQL injection giving full admin access, already tied to a real breach. What to check in 24 hours.
Read →
SOC vs MDR vs SIEM for iGaming
SOC, MDR, and SIEM are three different operating models, not the same purchase — here is the decision framework and cost drivers for an iGaming platform.
Read →
Casino cashier security testing: the test-case matrix
The specific test cases a penetration test of an online casino cashier should cover — deposit, withdrawal, bonus engine, API, and privileged-access — so you can check a vendor's scope before signing.
Read →
Online casino account takeover: what to do now
The signals that confirm an online casino account takeover is happening now, and the first 24 hours a SOC should follow before escalating to incident response.
Read →
Incident response retainers for online casinos
Incident response retainers for online casinos only beat a cold engagement if onboarding, evidence preservation, and SLA triggers are signed in advance.
Read →
Scoping a penetration test for an online casino
How to scope penetration testing for an online casino: what's in the RoE, which assets matter, what drives cost, and what the report contains.
Read →
Managed SOC for iGaming
Managed SOC for iGaming only works if log sources, detection coverage, and response boundaries are fixed before onboarding, not during the first incident.
Read →
Scoping DDoS stress testing for an online casino
DDoS stress testing for an online casino only proves resilience if the RoE, provider coordination, and abort conditions are scoped correctly first.
Read →
Vulnerability assessment vs penetration testing
Vulnerability assessment vs penetration testing for iGaming: what each one covers, the evidence each produces, and how a casino decides which it truly needs.
Read →
CVE-2026-32194: your SVG uploads may be next
Bing Images had a CVSS 9.8 SVG-to-RCE flaw via ImageMagick delegates. If your app processes user-uploaded images server-side, check this today.
Read →
CVE-2026-54121: any AD user can seize your domain
CVE-2026-54121 ("Certighost") lets a low-privileged Active Directory user impersonate a Domain Controller and compromise the domain. What to check this week.
Read →
CVE-2026-16232: auth bypass in Check Point console
CVE-2026-16232 lets an unauthenticated attacker log into Check Point SmartConsole with full admin rights and rewrite firewall policy. Check this in 24 hours.
Read →
How to protect an online casino from DDoS attacks
A 2026 guide to protecting an online casino from DDoS attacks: anycast absorption, L7 filtering, origin isolation, and the runbook that keeps betting live.
Read →
Credential stuffing against casino cashiers
Credential stuffing rarely loses money at login — the loss lands at the cashier. The full attack chain against casino withdrawal flows, and how to break it.
Read →
When your SOC tool is the target: CVE-2026-20253
CVE-2026-20253 is an unauthenticated RCE in Splunk Enterprise, now on CISA's KEV list. If your SOC platform is internet-reachable, it's attack surface too.
Read →
The casino cybersecurity threat landscape in 2026
What we've seen actually hitting licensed online casinos this year — bonus abuse, withdrawal fraud, and the slow rise of AI-assisted social engineering.
Read →
Building a SOC for a crypto exchange from scratch
Detection rules, alert thresholds, and on-call playbooks for threats unique to a regulated exchange — wallet drainers, custody compromise, address-poisoning.
Read →
NIS2 + DORA without the consultant theatre
What EU operators actually need to do to be ready for NIS2 and DORA — control by control, with the time and effort to expect.
Read →
Anatomy of a modern L7 DDoS attack
What we see hitting casino and exchange edges in 2026 — and why provider defaults don't catch it.
Read →
Why we still do pure-manual penetration testing
Automated scanners have improved and PTaaS platforms are everywhere. Here's why our senior engineers test by hand, and what they catch that scanners don't.
Read →
What a real pentest report looks like
If your last pentest report was a Nessus PDF export, you got scammed. Here's exactly what to demand.
Read →
Building a private Anycast edge from scratch
Why some of our clients run their own ASN, IP blocks, and edge — the trade-offs vs Cloudflare, and how the math actually works.
Read →Facing something you'd rather not write about later?
Talk to the engineers behind these write-ups. Thirty minutes, no sales script — just a straight read on where you stand.
Book a call