The VITI Security Blog
Practical writing on managed IT + cybersecurity.
By the engineers doing the work - not a marketing team summarizing it. We write when we have something to say, not when the calendar says we should.
FTC Safeguards Rule for Tax Preparers: What Publication 4557 Actually Demands
A practical breakdown of the FTC Safeguards Rule and IRS Publication 4557 for CPA firm partners, detailing mandatory technical controls.
OpenAI Watermarking: What SMB Security Teams Must Know
OpenAI is rolling out invisible watermarks for ChatGPT and Codex in the EU. Here is what this means for SMB security operations and data governance.
IRS WISP Checklist: Secure Your Tax Firm Before PTIN Renewal
Every tax preparer needs a robust Written Information Security Plan (WISP) to meet IRS requirements and ensure PTIN renewal. This checklist guides you through the essential controls and best practices.
Autonomous AI Agents and Endpoint Security: A New Frontier
The potential for AI agents like Google Gemini to gain deep macOS access fundamentally shifts endpoint security paradigms. We need to reassess traditional controls and implement robust strategies for monitoring and containing these powerful tools.
Why Enterprise Security Questionnaires Keep Blocking Your SaaS Deal
Enterprise security questionnaires often block SaaS deals not because of bad luck, but because they reveal an immature security program. The fix requires proactive strategy, a solid compliance foundation like SOC 2, and robust control implementation.
FortiMail Zero-Day: Beyond the Patch - Hardening Your Email Perimeter
A critical FortiMail vulnerability (CVE-2026-104286) exploited in zero-day attacks underscores the urgent need for robust email gateway security practices beyond just patching. Practitioners must focus on defense-in-depth, network segmentation, and proactive incident readiness.
Your SOC 2 Type II Readiness Checklist: A Startup's Guide
For SaaS teams of 10-30 people, SOC 2 Type II readiness means establishing and consistently operating core security controls for at least six months. This guide breaks down the essential steps to prepare for your first audit.
Securing WSL Containers in SMB Environments: A Practitioner Guide
Microsoft has made WSL containers generally available, bringing native Linux container orchestration directly to Windows endpoints. Here is how to secure this new attack surface.
SOC 1 vs SOC 2: Picking the Right Report for Your SaaS Platform
When a customer's finance team asks for a SOC report, for most SaaS platforms, they need a SOC 2 report, not a SOC 1, to assess security and availability controls. Understanding the distinction is key to providing the correct assurance.