Cyber Security Blog

Blog posts about Cyber Security, Pentesting, Cloud Security and Red Teaming from our team.

Social Engineering

ClickFix: How Fake CAPTCHAs Trick Users Into Self-Infection

ClickFix makes users run malicious code themselves. How the fake-CAPTCHA scheme works and how organizations can defend against it.
Jan Kahmen
Jan Kahmen
6 min read
Incident Response

Traffic Light Protocol (TLP): How to Share Sensitive Information Correctly

How Traffic Light Protocol (TLP) 2.0 governs the exchange of sensitive security information: labels, marking rules, and common pitfalls in practice.
Jan Kahmen
Jan Kahmen
4 min read
Cloud Security

Penetration Testing in the BSI C5 Attestation: What Cloud Providers Must Prove

BSI C5 requires penetration testing explicitly. Which frequency, tester qualification, and report are needed for the C5 attestation.
Jan Kahmen
Jan Kahmen
6 min read
Incident Response

The CRA Reporting Obligation From September 2026: What Manufacturers Must Prepare Now

From 11 September 2026 the Cyber Resilience Act reporting obligation applies. What manufacturers must report, which deadlines apply and why the 24-hour clock fails in practice.
Jan Kahmen
Jan Kahmen
5 min read
Infrastructure Penetration Test

Active Directory Certificate Services (AD CS): Attacks Beyond the Classics (ESC9 Through ESC16)

ESC9 through ESC16 in Active Directory Certificate Services: the escalation techniques that classic ESC1–ESC8 guides leave out, with precondition and hardening.
Jan Kahmen
Jan Kahmen
7 min read
Penetration Test

What Is a Security Advisory?

A security advisory documents a vulnerability with its severity, affected versions and patch. How an advisory is structured and how it comes to be.
Jan Kahmen
Jan Kahmen
6 min read