Resources
Insights
Guidance on compliance, threats and security engineering from the people who do the work.
October 28, 2026 · 4 min read
The OWASP Top 10 for Decision-Makers
The OWASP Top 10 is the most widely cited list of web application security risks, and it shows up in contracts, test reports and training plans. What it is, how leaders can use it well, and what it was never meant to cover.
Read moreOctober 27, 2026 · 4 min read
Protecting Your Domains and DNS From Hijacking
Whoever controls your domain controls your website, your email and much of your users' trust. How domain and DNS hijacking happen, and how registrar security, locks, DNSSEC, CAA records and cleanup of dangling records reduce the risk.
Read moreOctober 26, 2026 · 4 min read
API Security: Inventory, Authorization and Abuse
APIs now carry much of the data that web pages once did, and attackers call them directly. Why API inventories go stale, why object-level authorization is the most common failure, and how rate limits, logging and testing reduce abuse.
Read moreOctober 25, 2026 · 4 min read
Secrets in Code: Keys, Tokens and Passwords
API keys, cloud credentials and database passwords end up in source code, CI logs and chat messages more often than anyone intends. Where secrets leak, how vaults and short-lived credentials help, and what to do the moment one is exposed.
Read moreOctober 24, 2026 · 4 min read
Patch Management That Keeps Pace
Most breaches that start with a known flaw had a fix available. A patch program that keeps pace needs a predictable routine, a fast lane for emergencies, a way to roll back, and proof that the fixed version is what is actually running.
Read moreOctober 23, 2026 · 4 min read
OpenSSL DTLS Flaw CVE-2026-84782: What to Check
A high-severity OpenSSL flaw in DTLS can leak heap memory to a remote peer or crash the service. What DTLS is, where it hides in VPNs, voice and IoT, why distribution version numbers mislead, and how to patch.
Read moreOctober 23, 2026 · 4 min read
Cyber Hygiene for Small Defense Suppliers
Small defense suppliers often have limited staff and budget but face the same attackers as large primes. A prioritized starting point: MFA, patching, backups, inventory, least privilege and logging, and how they relate to CMMC Level 1.
Read moreOctober 22, 2026 · 4 min read
Incident Communications: Customers, Staff, Partners
During a cyber incident, what you say and when you say it can matter as much as the technical response. Who decides, how to use holding statements, why accuracy beats speed, and how to handle contractual, regulatory and law-enforcement contacts.
Read moreOctober 22, 2026 · 5 min read
PHP2Shell: What to Do About the Critical PHP Flaws
Two critical flaws in PHP itself, nicknamed PHP2Shell, can allow unauthenticated remote code execution on web servers. Who is affected, how to find every copy of PHP, how to patch, and what to do if you cannot patch today.
Read more
Let's talk
Ready to strengthen your security posture?
Talk with a CDT engineer about your mission, your systems and your deadlines. We'll tell you honestly what it takes.