Cybersecurity Blog
There’s a good chance your organization has a password policy that looks something like this: passwords must be at least eight characters, contain uppercase and lowercase letters, a number, and a special character, and be changed every 90 days. There’s also a reasonable chance your…
Most people imagine cybersecurity threats arriving through the internet, like a phishing email, a brute-forced password, or ransomware from a malicious link. But some of the most direct paths into an organization’s systems don’t require any hacking at all. They just require walking through the…
During an internal penetration test for a municipality, our testers discovered something the client almost certainly didn’t know was accessible: a section of the network containing concealed carry permit records. This included personal information and sensitive law enforcement data. It was the kind of records…
Most organizations that reach out to MainNerve about a penetration test have been thinking about it for a while. Sometimes months. They know they need one because an insurance carrier asked for it, a client required it, or they’ve been reading about breaches in their…
If you’ve worked with MainNerve on a risk assessment, there’s a good chance RealCISO has come up in that conversation. We offer it to clients as a way to take ownership of their own security posture. It’s a platform that guides organizations through structured risk…
Price is almost always the last question in a penetration testing conversation, and it’s usually the one that makes people the most uncomfortable, on both sides of the table. Clients don’t want to seem like they’re shopping on price alone. Vendors don’t always want to…
If you’ve ever received a penetration test report and felt like the severity ratings didn’t quite match your intuition about what was serious, you’re not imagining things. Severity ratings are one of the most consequential parts of any pen test report. Organizations use them to…
If you’re an MSP, an IT consultant, a VAR, or any kind of technology services provider, there’s a good chance your clients are starting to ask about penetration testing. Maybe a cyber insurance carrier required it on the renewal application. Maybe a client received a…
There’s a moment in almost every scoping conversation where we ask something like, “Do you have a penetration test budget in mind?” And there’s a predictable pause on the other end. We understand why. The assumption most people make is that asking for a budget…
When clients schedule an internal network penetration test, one of the first questions we hear is some version of: “Can you do it after hours so it doesn’t disrupt anything?” It’s a reasonable instinct. The idea is that running a security test while employees are…
When something goes wrong with the internet connection, a printer won’t connect, or a new employee needs their laptop set up, you call your IT person. They fix it. Problem solved. It’s one of the more satisfying parts of running a business: having someone who…
There’s a story most small business owners tell themselves about cybersecurity. It goes something like this: hackers are out there targeting banks, hospitals, and major corporations. They’re after the big scores, millions of records, massive ransom payments, headline-grabbing breaches. A small business with 20 employees…
