CVSS vs EPSS vs KEV: Which Signal Should Decide What You Patch First?
CVSS says how bad a flaw could be, EPSS estimates how likely it is to be attacked, and KEV records that it already has been. Seven recently exploited …
All articles
Every FirewallSync article, newest first.
Passkeys vs Passwords: What Actually Changes for Security Teams?
Passkeys aren't just a more convenient password. They remove an entire attack category at the protocol level, but only if recovery and enrollment are …
Data Minimization: The Privacy Principle Most Teams Skip
Collecting more data than you need feels harmless because storage is cheap. The actual cost shows up later, at breach time, at deletion-request time, …
ZITADEL Account-Takeover Flaws CVE-2026-105207, -105209 and -105215: Fixed Versions and What to Check
Three critical ZITADEL flaws let attackers take over accounts through external identity provider linking, passkey enrollment and forged login …
NetScaler CVE-2026-88779: Exploited SAML Flaw Needs Newer Builds Than Last Week's Zero-Day Fixes
CVE-2026-88779 can knock SAML-configured NetScaler ADC and Gateway appliances offline and is on CISA's exploited list. The fixed builds are newer than …
Cisco Catalyst SD-WAN Manager CVE-2026-76504: Fixed Releases and Log Checks
Cisco says an unauthenticated authentication bypass in Catalyst SD-WAN Manager is being exploited. There is no workaround, only upgrades, a temporary …
Zammad Zero-Days CVE-2026-102489 and CVE-2026-102490: What Is Fixed and What Is Not
Two Zammad flaws chained in the breach of the Dutch Institute for Vulnerability Disclosure are on CISA's exploited list. The sources disagree on which …
What GDPR Actually Requires: A Plain-English Breakdown for Engineering Teams
GDPR compliance often gets treated as a legal problem handed to legal teams. Several of its core requirements are actually engineering decisions, and …
How to Detect and Rotate Leaked API Keys Before Attackers Use Them
A leaked API key isn't automatically compromised, but you often can't prove it wasn't used. Here's how to find exposure fast and rotate without …
Vetting Third-Party SaaS Tools Before They Touch Your Data
Most SaaS vetting stops at a security questionnaire the vendor's sales team fills out. Here's what actually predicts third-party risk in practice.
Encryption at Rest vs Encryption in Transit: What Each Actually Protects Against
Both terms get used as a single checkbox on a compliance form, but they protect against completely different threats — and having one without the …
Argon2id vs bcrypt vs scrypt: OWASP Parameters to Use
Use Argon2id for new systems, keep bcrypt if you already have it and handle its 72-byte limit, and use PBKDF2 only when FIPS requires it. The harder …