Cyber Security Blog

Blog posts about Cyber Security, Pentesting, Cloud Security and Red Teaming from our team.

Incident Response

Preparing for Zero Days: Resilience Over Prevention

Time-to-exploit sits at minus 7 days and the KEV catalog grows weekly. How organizations prepare for vulnerabilities without a patch.
Jan Kahmen
Jan Kahmen
3 min read
Penetration Test

CRA and Pentests: What the Cyber Resilience Act Requires in Security Testing

The CRA demands effective, regular security testing. What Annex I requires, how BSI TR-03183 makes it concrete, and where pentests fit in.
Jan Kahmen
Jan Kahmen
3 min read
Social Engineering

ClickFix: How Fake CAPTCHAs Trick Users Into Self-Infection

ClickFix makes users run malicious code themselves. How the fake-CAPTCHA scheme works and how organizations can defend against it.
Jan Kahmen
Jan Kahmen
6 min read
Incident Response

Traffic Light Protocol (TLP): How to Share Sensitive Information Correctly

How Traffic Light Protocol (TLP) 2.0 governs the exchange of sensitive security information: labels, marking rules, and common pitfalls in practice.
Jan Kahmen
Jan Kahmen
4 min read
Cloud Security

Penetration Testing in the BSI C5 Attestation: What Cloud Providers Must Prove

BSI C5 requires penetration testing explicitly. Which frequency, tester qualification, and report are needed for the C5 attestation.
Jan Kahmen
Jan Kahmen
6 min read
Incident Response

The CRA Reporting Obligation From September 2026: What Manufacturers Must Prepare Now

From 11 September 2026 the Cyber Resilience Act reporting obligation applies. What manufacturers must report, which deadlines apply and why the 24-hour clock fails in practice.
Jan Kahmen
Jan Kahmen
5 min read