DRPS Articles
Free Domain Security Checks: DMARC, TLS and Exposed Assets in One Afternoon
Eight free domain checks with the exact commands: DMARC, SPF, DKIM, MTA-STS, TLS, CAA, certificate logs and security.txt, run on our own domain.
Blog · 528 Articles
Blog. Cybersecurity And Risk.
Threat actors, dark web activity, ransomware and digital risk, explained by the analysts who track them.
02 All Articles
All Blog Articles. Newest First.
Ransomware
The Gentlemen Ransomware Claims 38 Victims in One Day
On 26 October 2026 Blackhole recorded 38 victim entries credited to The Gentlemen, not verified by us. Here is the batch pattern and what to patch first.
Ransomware
Ransomware in September 2026: 857 Victims Across 82 Groups, and What October Added
Atlas data: 857 ransomware victims from 82 groups in September 2026. See the top groups, sectors, countries and what October added so far.
News Explainer
CAASM vs EASM: The Inside View and the Outside View of Your Assets
CAASM reads your own tools; External Attack Surface Management (EASM) looks in from the internet. See what each one finds and misses, with CISA and NCSC guidance on asset discovery.
How-To Guide
Build a Threat Intel MCP Server in Python With No API Keys
Build a read-only threat intelligence Model Context Protocol (MCP) server in Python with FastMCP, using NVD, CISA KEV, EPSS and Shodan InternetDB, then connect it to Claude Code.
News Explainer
Claude Agent SDK in Python: Build an Alert Triage Agent
A Claude Agent SDK tutorial in Python: build an alert triage agent that calls an MCP server, blocks other tools with a hook and waits for approval.
News Explainer
OpenCTI vs MISP Compared: Run Both Locally and Query Them With an AI Agent
Compare OpenCTI and MISP side by side on data model, API, memory and license, then run both in Docker and query them with an AI agent over MCP.
News Explainer
Turn a Threat Report Into ATT&CK Mappings and Sigma Rules With an AI Agent
Let an AI agent map a CISA advisory to ATT&CK and draft Sigma rules, then check them with sigma-cli, pySigma and ATT&CK data. A real run, with fixes.
News Explainer
SOC Triage With the Elastic MCP Server and a Brandefense MCP Stand-In
Connect Claude Code to the Elastic MCP server and a Brandefense MCP stand-in, triage a VPN alert with real tool calls and get a sourced note.
How-To Guide
Build a Brand and Phishing Watch With dnstwist, crt.sh and an AI Agent
Run dnstwist and crt.sh as read-only MCP tools. Of 7,503 name variations 8 resolve: 4 ours, 4 look-alikes. Claude Code drafts a takedown a person approves.
News Explainer
MCP Scanner Test: Three Tools Against a Poisoned MCP Server
Snyk Agent Scan, Cisco MCP Scanner and devlab on a clean and a poisoned MCP server: what each caught, what it sent out and which false alarms it raised.
News Explainer
Red Team Your Threat Intel Agent With Garak, Promptfoo and PyRIT
Run garak, promptfoo and PyRIT against a threat intel agent, map the findings to MITRE ATLAS and OWASP, fix them and re-run to see the before and after.
03 More To Read
010203040506
Threat Research
What a 0-Day Ad Really Sells: 37 of 93 Are Unnamed-Exploit Claims
Threat Research
What WormGPT and Other AI-Branded Tool Ads Sell
Threat Research
Why Web Shell, cPanel and RDP Prices Do Not Add Up
Threat Research
The September Surge in Access-Labelled Posts
Threat Research
Most Initial Access Offers We Read Sold Websites, Not Networks
Threat Research
Anatomy of a Corporate Network Access Listing
05 FAQ
About The Blog.
Knowledge Hub →01What does the Brandefense blog cover?
Articles on ransomware, APT groups, the dark web, digital risk protection, fraud, sector analysis and VIP security, written for security teams.
02How often is the blog updated?
The newest articles appear first, and every article shows its publish date.
03How do I find articles on one topic?
Use the topic links above the list to open one topic, or type a word in the search box. Search and topic filters cover the full article collection.
04Where do the facts in the articles come from?
Articles draw on public sources such as CISA advisories, MITRE ATT&CK and ENISA reports. Sources are listed at the end of an article when it cites them.
05How do I get new articles by email or feed?
The site feed at brandefense.io/feed/ lists new posts. The email sign-up box is on the All Resources and Reports pages.
06What does Brandefense do?
Brandefense is an AI-driven threat intelligence company. Its platform covers cyber threat intelligence, digital risk protection and external attack surface management. You can request a demo from the Request A Demo page.
07How many articles are on the Brandefense blog?
This collection currently contains 528 public articles. The page shows the total at the top and the count for each topic next to its name. Each article shows its publish date.
08Who writes the Brandefense blog?
The blog describes its articles as explained by the analysts who track threats. They cover threat actors, dark web activity, ransomware and digital risk. The newest articles appear first.
09Does the blog have articles about APT groups?
Yes. The Knowledge Hub also holds profiles of threat groups. Use the topic links or article search to explore the coverage.
10What is the difference between the deep web, the dark web and the surface web?
The surface web is the part of the internet that search engines list. The deep web is content that search engines do not list, such as pages behind a login. The dark web needs special software to reach.
Stay Ahead of Digital Threats.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.