11 min read
Power Pages Misconfiguration: No CVE, No Patch
Two financial regulators flagged a Microsoft Power Pages setting that exposes Dataverse records. No CVE, no patch, and your scanner will not see it.
cybersecurity
13 min read
The Last Basic Authentication Deadline: SMTP AUTH Changes in December 2026
In This Article What actually changes at the end of December 2026 What in your institution still sends mail this way How to find every dependency...
11 min read
Knight Office AiTM Kit: Persistence Past Password Reset
In This Article What Huntress found How this differs from the August Windows Hello research The step that survives your incident response Whether...
15 min read
Shadow IT in Financial Institutions: Find It, Govern It
Your staff already told you which tools they need. They just did not ask first. How to find unsanctioned apps in a Microsoft 365 tenant with Defender...
12 min read
The 36-Hour, 72-Hour, and 30-Day Incident Reporting Clocks
Three federal rules, three deadlines, and three different definitions of the moment the clock starts. What triggers each one, and what Microsoft 365...
12 min read
Conditional Access Exclusions: The List Nobody Reviews
Every institution grants Conditional Access exceptions. Microsoft documents how those lists grow, names access reviews as the compensating control,...
9 min read
You Might Be Running a Financial Institution. The FTC Thinks So.
In This Article The Label You Did Not Choose Who Is Covered? The List Is Longer Than You Think What the Safeguards Rule Actually Requires What...
15 min read
Windows Hello for Business Key Abuse: What Financial Institutions Need to Verify
Malware already running in a signed-in Windows session can use that user's Windows Hello for Business key to authenticate to Microsoft Entra ID, with...
13 min read
Payroll Pirates: The Microsoft 365 Attack Your Alerts Miss
A Microsoft 365 session-hijacking campaign is reading payroll and finance mail while deliberately avoiding the account-modification signals most...
14 min read
Entra Risk Policies Retire Oct 1, 2026: What Banks Must Do
In This Article What actually changes on October 1 The self-service loop that goes away first The detections keep firing. No risk policy acts on...
