Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Sandworm in the supply chain: Lessons from the Shai-Hulud npm attack on developer and machine identities

Do you know why Shai-Hulud should raise your hackles? Unless you’ve spent time on Arrakis in Frank Herbert’s Dune or the npm ecosystem this month, the name Shai-Hulud might not ring a bell. In Herbert’s world, Shai-Hulud is the colossal sandworm of Arrakis—feared, powerful, and destructive. In our world, I guess you could say the same thing. Shai-Hulud surfaced as a malware worm that tore through the npm software registry on Sept. 16–17, 2025.

Scattered Spider: the Evolution of Identity-Based Ransomware

Identity-based ransomware is no longer a fringe tactic; it’s becoming the playbook of today’s most dangerous adversaries. Scattered Spider, a financially motivated e-crime group, has shifted the model from smash-and-grab encryption to a far more devastating combination of double extortion, social engineering, and hypervisor encryption attacks.

Persuasion engineering: how to influence humans, LLMs, and AI agents

We’ve spent decades treating persuasion like an art—something you could master if you had charisma, practice, or luck. Lawyers use it to hone arguments. Marketers use it to craft taglines. On the flip side, phishers use persuasive tactics to sharpen lures to razor points. But looking at it as an art form, while intuitive for some, can be messy. Hit-or-miss. Especially when you consider that today’s means of persuasion can run like code: systematic, reproducible, and scalable.

Building Cyber Resilience: Why Machine Identity Automation Is the Future of IoT Security

The modern enterprise is no longer defined by its physical offices or centralised networks. Instead, it is shaped by an expanding digital ecosystem of devices, applications, and cloud platforms. Nowhere is this shift more evident than in the Internet of Things (IoT), where billions of devices interact across healthcare, automotive, manufacturing, and energy sectors.

A practical guide to AI-ready machine identity governance in finance

Across financial services operations, machine identities play critical roles, but in many organizations, these cryptographic keys, API tokens, certificates, and service accounts remain chronically under-governed. What’s more, machine identities outnumber human identities by staggering margins, creating a massive, often unseen, unsecured attack surface—one that’s only further compounded by the rise of artificial intelligence (AI).