Cyber Sec — ArticlesVulnerability research, red team operations, detection engineering and security tooling. Authorized, evidence-based security work.2026-08-31T00:00:00+02:00https://cybersec.org.za/feed.xmlStephan BotesstephanbotesIT@proton.meCan 2FA Replace Passwords? Double 8-Digit TOTP, Stress-Testedhttps://cybersec.org.za/article-passwordless-double-totp.html2026-08-31T00:00:00+02:002026-08-31T00:00:00+02:00Two 30-second 8-digit 2FA codes instead of a password: the brute-force math, the fail-anywhere-restart rule, and the honest gaps. Feasibility research from Cyber Sec.Dynamic Context Runtime: Bounded Attention over Unbounded Historyhttps://cybersec.org.za/research-dcr-bounded-attention.html2026-08-21T00:00:00+02:002026-08-21T00:00:00+02:00A runtime that separates unbounded history from bounded attention: a representation ladder, a provenance graph, and a budgeted context planner. Measured at 145 tokens per query over a 27,362-token transcript, flat across 33x history growth.Rise in Ransomware Targeting Healthcarehttps://cybersec.org.za/article-ransomware-healthcare.html2026-07-01T00:00:00+02:002026-07-01T00:00:00+02:00Why healthcare keeps getting hit, how these intrusions actually unfold from initial access to double extortion, and the controls that break the chain.How to Triage a Critical CVEhttps://cybersec.org.za/article-critical-cve-triage.html2026-06-25T00:00:00+02:002026-06-25T00:00:00+02:00A new critical CVE drops and everyone panics. A calm, repeatable playbook for deciding whether it's actually your emergency — exposure, exploitability, and smart patching.Reverse-Engineering an Enterprise VPN Clienthttps://cybersec.org.za/article-reverse-engineering-vpn.html2026-06-09T00:00:00+02:002026-06-09T00:00:00+02:00A field methodology for tearing down a privileged VPN client — static triage, dynamic observation, the authentication handshake, the IPC privilege boundary, and responsible disclosure.Building a Detection Engineering Programhttps://cybersec.org.za/article-detection-engineering-program.html2026-05-28T00:00:00+02:002026-05-28T00:00:00+02:00From raw logs to alerts that actually fire — a threat-driven, build-and-own approach to detection engineering with Wazuh/Elastic, detection-as-code, and validation.Building Memory-Safe Offensive Tooling in Rusthttps://cybersec.org.za/article-rust-offensive-tooling.html2026-05-12T00:00:00+02:002026-05-12T00:00:00+02:00Why we write offensive security tooling in Rust — memory safety, fearless concurrency, single static binaries, and the patterns that keep custom tools reliable under fire during an engagement.State-Sponsored Threat Actor Patternshttps://cybersec.org.za/article-apt-threat-actor-patterns.html2026-04-20T00:00:00+02:002026-04-20T00:00:00+02:00How nation-state operators differ from commodity criminals — initial access, living off the land, persistence, and long dwell time — and what it means for your defenses.Incident Response Tabletop Exerciseshttps://cybersec.org.za/article-ir-tabletop-exercises.html2026-04-08T00:00:00+02:002026-04-08T00:00:00+02:00Your incident-response plan is a hypothesis until someone tests it. How to run a tabletop that surfaces decision and communication gaps — with four ready-to-run scenarios.Supply Chain Security Assessment Frameworkhttps://cybersec.org.za/article-supply-chain-assessment.html2026-03-22T00:00:00+02:002026-03-22T00:00:00+02:00A vendor-agnostic method for evaluating third-party and dependency risk — inventory and SBOM, build provenance, dependency review, and appliance testing with reproducible evidence.Beyond the Scanner: Why Manual Penetration Testing Mattershttps://cybersec.org.za/article-beyond-the-scanner.html2026-03-05T00:00:00+02:002026-03-05T00:00:00+02:00Automated scanners find the known; attackers exploit the unknown. Why business-logic flaws, chained exploits, and real impact only surface with a human tester in the loop.Red Team Operations Playbookhttps://cybersec.org.za/article-red-team-playbook.html2026-02-18T00:00:00+02:002026-02-18T00:00:00+02:00How to plan, run, and actually learn from a red team engagement — objective-driven adversary emulation, rules of engagement, and the purple-team turn that tunes your detections.Compliance to Security: Bridging the Gaphttps://cybersec.org.za/article-compliance-to-security.html2026-02-10T00:00:00+02:002026-02-10T00:00:00+02:00A clean audit is not a secure system. How to turn a compliance checkbox into real resilience — threat-model your environment, test like an attacker, and fix root causes.The 2026 Enterprise Security Landscapehttps://cybersec.org.za/article-2026-security-landscape.html2026-01-15T00:00:00+02:002026-01-15T00:00:00+02:00The trends that actually moved enterprise risk in 2026 — identity-first attacks, exposed edge appliances, ransomware-as-a-service, and supply-chain exposure — with the defensive priorities that matter.