Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

As the Asia-Pacific and Japan (APJ) region continues its rapid digital acceleration, Guam stands at a unique strategic intersection. Serving as a critical hub for telecommunications, government services and regional defense, the island’s cybersecurity posture is no longer just a local concern, it is a cornerstone of regional stability. I have observed a proactive shift toward onboarding various agencies to a unified security framework.

Social engineering remains a central part of modern cyberattacks, according to a new report from CrowdStrike. Attackers are increasingly turning to voice phishing because it bypasses traditional security controls and leaves little forensic evidence, since the social engineering takes place over the phone.

Americans are now losing an estimated $148 billion each year to online scams, a 22% increase compared to 2024, according to a new report from the Consumer Federation of America (CFA). The FBI’s Internet Crime Complaint Center (IC3) tracked $20.8 billion in losses last year, but the CFA notes that the actual losses are much higher.

Access control has become significantly more complex as enterprises adopt cloud platforms, AI applications, and distributed workforces. A user’s identity alone is no longer enough to determine whether they should access sensitive data. Factors such as device posture, data sensitivity, location, and business context all influence the right decision. This shift is driving widespread adoption of attribute-based access control, a model that evaluates multiple attributes before granting access.

AI DLP (artificial intelligence data loss prevention) is a category of data protection that inspects the prompts and file uploads an employee sends to a generative AI tool, before that content reaches the model, which is what separates it from file-based or network-based DLP.

FedRAMP has long been one of the more complex certifications you can achieve, but the rewards are well worth the effort. Validating your company's information security is a huge benefit, and on top of that, working with the government on sensitive contracts is a lucrative business venture. We do our best to explain various aspects of FedRAMP in plain English, to make it easier to figure out what your goals should be and where you should place your efforts.

Every AI approval a security team makes feels reasonable in isolation. A security architect signs off on a generative AI writing tool for marketing. An engineering lead spins up an agent to triage support tickets. A finance team connects a copilot to its planning software. Individually, none of these decisions looks risky.

Top tips is a weekly column where we highlight what's trending in the tech world and share practical ways to navigate these shifts. This week, we're looking at spear-phishing: how cybercriminals weaponize social engineering, why your natural instinct can act as a security blind spot, and practical steps to verify suspicious requests before you take action. I would like to make a confession: I’m a well-versed tech expert, but I almost fell for a phishing scam.

Most organizations experience a strange DNS problem at some point: The same domain name means something different depending on who's asking for it. For example, a single internal app, workspace.company.com, might need to serve a locked-down instance to finance, a live staging build to engineering, and a stable production build to support — all under one domain and from the same DNS server.