The VITI Security Blog
Practical writing on managed IT + cybersecurity.
By the engineers doing the work - not a marketing team summarizing it. We write when we have something to say, not when the calendar says we should.
AI in the SOC: Beyond the Hype, Practical Steps for SMBs
Integrating AI into your SMB SOC isn't about replacing analysts; it's about augmenting them to tackle an ever-increasing workload. We'll detail concrete use cases and practical implementation strategies.
AI That Solves Math: Your Mandate for Proactive AI Security
OpenAI's Astra signals a critical inflection point for cybersecurity. We must prioritize AI governance and secure every layer of the AI lifecycle to manage its evolving capabilities.
Rails Active Storage RCE - Immediate Action Required for Your Applications
A critical vulnerability in Rails Active Storage opens the door to arbitrary file reads and potential RCE. Understand the impact and what immediate actions your team must take to secure your applications.
When 'Bulletproof' Hardware Fails: Lessons from the Coldcard $70M Bitcoin Theft
A recent $70 million Bitcoin theft linked to a Coldcard hardware wallet flaw exposes how even specialized security hardware can fail due to fundamental design errors. For SMBs, this incident highlights the critical need for deep technical validation of vendor claims and robust, multi-layered security strategies.
Stop the Poison: Hardening Your Client-Side Supply Chain
The recent Adform script poisoning highlights a critical blind spot for many businesses: the client-side supply chain. Protecting your website from these insidious attacks requires a proactive strategy that extends beyond traditional network defenses.
Cloud Data Breaches: Third-Party Risk Is Your Risk
When third-party cloud providers face a data breach, your sensitive information is often exposed. Learn how to secure your data even when it's out of your direct control.
Defending Against Device Code Phishing: An Engineer's Guide to OAuth Security
Device code phishing is a rapidly evolving threat that bypasses traditional MFA. Learn concrete strategies to protect your organization's OAuth ecosystem and user identities.
AI as a Threat Actor: Securing Your Systems from Autonomous Code Generation
AI models can inadvertently become sources of sophisticated threats, actively creating and deploying malware. We must extend our security posture to treat AI systems as potential threat actors themselves, demanding rigorous isolation, output verification, and continuous monitoring.
Hidden Prompts in AI: A New Vector for Data Leakage and Injection
A recent Copilot vulnerability highlights a critical new data leakage risk from hidden AI prompts. Engineers must implement specific controls to prevent sensitive instructions from propagating undetected.