Resources
The blog.
Long-form thinking from the practice—security, systems, law, and the work of staying clear-headed.
Latest
A Flocked Up World: Part 1
Flock Safety's network of about 120,000 AI license plate readers lets officers search a car's movements nationwide without a warrant. Misuse, from stalking to clinic lookups, shows why that power is hard to trust.
Kenneth Halling Oct 29, 2026 · Blog
Psychology-Aware Security Design
Cybersecurity products need affordances that guide people toward the right actions under stress. Psychology-aware design is how defenders catch up with attackers who already use it.
AI: The New Face of Cybersecurity
OpenAI and Anthropic AI agents are escaping sandboxes and exploiting vulnerabilities at machine speed. Learn what the Hugging Face breach reveals about AI's growing role in offensive and defensive cybersecurity.
The Limitations of Hashing for Data Anonymization
Why using hashing alone is an incomplete anonymization process
Fast16: The Malware that Could Topple a Building
SentinelOne researchers uncovered Fast16, malware that silently corrupted engineering and simulation software for over two decades—predating Stuxnet and capable of turning faulty calculations into real-world catastrophe.
The Stryker Wiper Attack
Iranian state-sponsored hackers disguised as hacktivists launched a devastating wiper attack on medical equipment maker Stryker, erasing data from nearly 80,000 servers and exposing the growing cyber warfare threat.
A Ring Retrospective
Ring's expanding surveillance capabilities raise critical questions about privacy, data security, and law enforcement access to millions of doorbell cameras across America.
The Big, Bad Kimwolf
A massive IoT botnet is stalking local networks worldwide, infecting millions of devices through off-brand Android TV boxes and exploiting residential proxy vulnerabilities.
My Core NetWars Experience: My First CTF Felt Like Stepping Into a Cybersecurity Pressure Cooker
A first-hand account of competing in Core NetWars, where red lights, intense music, and real-time scoreboards transformed cybersecurity training into an adrenaline-fueled competition that revealed both strengths and blind spots.
The Hijacking of Notepad++
A Chinese state-sponsored hacking group hijacked Notepad++'s update system for six months, demonstrating how even the best cybersecurity practices can't protect against third-party vulnerabilities.
Our AI Dystopia: Part 2 of 2
As AI-generated media fuels disinformation, we need solutions that scale. Learn how media literacy and proper AI regulation can help us grow alongside this technology rather than be constantly fooled by it.
Our AI Dystopia: Part 1 of 2
AI-generated media is getting more realistic and widespread, fueling disinformation and misinformation. Learn how fake images during Hurricane Helene and the LA wildfires exploited tragedy for propaganda and scams.
A Worse Kind of Earworm
Belgian researchers discovered that over a dozen earphone models using Google's Fast Pair protocol are vulnerable to WhisperPair attacks, potentially allowing hackers to hijack audio, track locations, and eavesdrop on users.
Shai-Hulud 2.0: The Worm Strikes Back
The malware plaguing the npm software registry spreads like the sandworms of Dune, replicating across hundreds of packages in a massive supply chain attack.
A Disturbance in Salesforce: How Human Error Became Cybersecurity's Biggest Threat
The ShinyHunters cybergang is exploiting human error to breach Salesforce databases at major corporations. Learn how vishing attacks are bypassing technical security measures and what your company can do to protect itself.
Spin.AI: Your Gateway to Cloud Data Protection
Discover how Spin.AI provides comprehensive SaaS security for Google Workspace users, offering automated backups, ransomware protection, risk assessment, and advanced data protection tools that traditional backup solutions can't provide.
Google Workspace vs Free Google Tools: Why it's better to use Google Workspace for your company
Many businesses rely on Google's free services for day-to-day operations. But are they good enough for security and compliance? Learn why upgrading to Google Workspace is a smart, cost-effective move.
Insights from IBM's Cost of Data Breach Report 2025: AI - The Inescapable Aspect of Security (Part 4 of 4)
AI is an inescapable aspect of modern security. Organizations with extensive AI use saved nearly $2 million per breach. Learn how to integrate AI effectively into your security strategy.
Insights from IBM's Cost of Data Breach Report 2025: Breach Lifecycle Summary (Part 3 of 4)
Data breaches have a 'lifecycle' similar to living creatures. Understanding the factors that extend or shorten this lifecycle is crucial for effective defense. Learn about phishing, supply chain attacks, and how to strengthen your cybersecurity posture.
Insights from IBM's Cost of Data Breach Report 2025: The Breach Lifecycle (Part 2 of 4)
The lifecycle of a data breach typically spans 200-300 days, with organizations often unaware of the breach for months. Learn how AI can dramatically reduce breach detection and recovery time.
Insights from IBM's Cost of Data Breach Report 2025: Opportunities and Challenges (Part 1 of 4)
Adopting AI tools for your security procedures and personnel can possibly prevent and mitigate the cost of a security breach. Learn how AI is reshaping cybersecurity defense and attack strategies.
The Stalkers in Our Pockets
Consider this: if someone was always watching what you did on your devices, would you change how you use them?
The IT Crowd of North Korea:
How the DPRK has made billions using their tech-savvy citizens to commit cybercrimes.
McDonald's AI Governance Wake-Up Call: When Corporate Rush Meets Security Reality
McDonald's AI hiring assistant vulnerability exposes millions of job applicants' data, highlighting the critical need for proper AI governance and security frameworks in corporate deployments.
AI and Compliance in 2025: is it a match or is it complicated?
IRS WISP Requirements: What Your Firm Needs to Know in 2025
Requisitos del WISP del IRS: Lo Que Su Firma Debe Saber en 2025
Navigating SEC Cybersecurity Disclosure Requirements: Ensuring Compliance and Building Trust
The Transformation of the 3LoD Model into an Advanced Persistent Defense
Learn how the Three Lines of Defense (3LoD) model has evolved to meet modern cybersecurity challenges and create an advanced persistent defense framework.
A Comprehensive Guide: Texas Biometrics Laws in 2024
Drawing the line between connected and consumed by social media
Understanding the Texas Data Privacy and Security Act
Wisdom: Not AI's Strongest Attribute
Ghidra Tutorial: CTF Challenge
Overview: Legal and Ethical Limitations of AI
Cybersecurity: a business concern, no just its
Ghidra Tutorial: Usage
From Morris Worm to Mirai: The Evolution of Cyberattacks
An Intuitive Introduction to Classification and Adversarial Input
Cybersecurity: Beyond Compliance and Checkboxes
Understanding the basics: Artificial Intelligence in Plain English
Ghidra Tutorial: CTF Challenge
Cybersecurity: is security a Myth or a Reality?
Navigating Crypto Risks: The Critical Role of Chainalysis in Asset Protection
NSA Codebreaker Challenge 2022 Task 9 Writeup
NSA Codebreaker Challenge 2022 Task 8 Writeup
NSA Codebreaker Challenge 2022 Task 6 Writeup
NSA Codebreaker Challenge 2022 Task 7 Writeup
NSA Codebreaker Challenge 2022 Task 5 Writeup
NSA Codebreaker Challenge 2022 Task B1 Writeup
NSA Codebreaker Challenge 2022 Task A2 Writeup
NSA Codebreaker Challenge 2022 Task A1 Writeup
Crimson Vista Partners with Curuvar on Grant from National Science Foundation
Crimson Vista announces participation with Curuvar on NSF SBIR grant for research and development work on decentralized root of trust infrastructure for defending critical information systems.
CISA Releases Top 10 Routinely Exploited Vulnerabilities
COVID-19, Contact Tracing, and Privacy
CoronaVirus: Cyber Hygiene when You're Working From Home
Cyber hygiene reminders for working from home: phishing, passwords, VPNs, and device updates.
Join Ellie for a panel on healthcare privacy for Data Privacy Day tomorrow!
Ellie joins a BrightTalk panel on healthcare privacy and security for Data Privacy Day.
Dr. Nielson to Speak at EDW
The State of Space 2020: a Recap
Privacy Law and Data Breach Litigatio
A Key Takeaway from Real World Crypto: Retire SHA1
Password Meters and Quick Tips
Dr. Seth Nielson Publishes First Book: Practical Cryptography in Python
Crimson Vista's Founder publishes comprehensive guide to writing cryptographic algorithms in Python, teaching correct cryptography through hands-on examples.
Crimson Vista Company Move
Crimson Vista relocated from Baltimore, Maryland to Austin, Texas.
Crimson Vista Teams with Brigham Young University to Work Together on Research Grant from Department of the Army
Crimson Vista selected with Brigham Young University to partner on Army Research Office grant for innovative ransomware mitigation technology.