News Explainer
APRA CPS 230 and CPS 234: What Service Provider Risk Means in Practice
CPS 230 and CPS 234 side by side: which clause asks for which evidence, the APRA notice deadlines and a service provider register template.
Blog · 528 Articles
Blog. Cybersecurity And Risk.
Threat actors, dark web activity, ransomware and digital risk, explained by the analysts who track them.
02 All Articles
All Blog Articles. Newest First.
Ransomware
AI Ransomware: 4 AI Tools That Crews Use
Four AI tools show up in primary reports on ransomware and extortion crews: Claude, Cursor Agent, DeepSeek and Qwen. Who used what, and what to watch.
News Explainer
How MSSPs Add Threat Intelligence to Their Services: A Rollout Plan
A rollout plan for MSSPs: which outside threat signals to add, how to keep client data apart, route alerts and package three service tiers.
News Explainer
Which Security Products and IT Tools Run on PHP?
MISP, GLPI and Zabbix run on PHP, and so do some firewall and VPN products. See vendor PHP2Shell status, including Check Point sk1000302, and what to do.
News Explainer
Brandefense Joins FIRST as an Associate Member
Brandefense joined FIRST, the Forum of Incident Response and Security Teams, as an Associate in October 2026. See what that means and what it does not.
News Explainer
Brandefense Wins at the Top InfoSec Innovator Awards 2026
Cyber Defense Magazine named Brandefense Most Innovative in AI-Powered Cybersecurity Solutions at the Top InfoSec Innovator Awards 2026.
News Explainer
PHP End of Life: Which Versions Still Get Security Fixes
PHP 7.4, 8.0 and 8.1 are end of life, and 8.2 follows on 31 December 2026. See every branch date and what our free PHP check saw.
Dark Web
Google’s Dark Web Report Is Gone: What to Use Instead
Google shut its dark web report on 16 February 2026. We ran Have I Been Pwned and our own Atlas tool on test inputs and show what came back.
DRPS Articles
How the Phishing Takedown Process Works, Step by Step
Who controls a phishing page, what ICANN's 2024 rules require and how to escalate: the phishing takedown process as an operator's playbook.
News Explainer
NYDFS Part 500 in 2026: What Covered Firms Must Show
NYDFS Part 500 now requires MFA, an asset inventory and a yearly notice by April 15. Here is what covered firms must show and where outside data helps.
DRPS Articles
Typosquatting: How Lookalike Domains Catch Your Users
Typosquatting turns one mistyped letter into a phishing site. See the main patterns, how attackers use them and how to spot and remove them early.
News Explainer
Vendor Risk Assessment From the Outside In
A vendor risk assessment should not stop at a questionnaire. Here is how to add outside-in evidence, tier vendors and keep the review current.
03 More To Read
010203040506
Threat Research
What a 0-Day Ad Really Sells: 37 of 93 Are Unnamed-Exploit Claims
Threat Research
What WormGPT and Other AI-Branded Tool Ads Sell
Threat Research
Why Web Shell, cPanel and RDP Prices Do Not Add Up
Threat Research
The September Surge in Access-Labelled Posts
Threat Research
Most Initial Access Offers We Read Sold Websites, Not Networks
Threat Research
Anatomy of a Corporate Network Access Listing
05 FAQ
About The Blog.
Knowledge Hub →01What does the Brandefense blog cover?
Articles on ransomware, APT groups, the dark web, digital risk protection, fraud, sector analysis and VIP security, written for security teams.
02How often is the blog updated?
The newest articles appear first, and every article shows its publish date.
03How do I find articles on one topic?
Use the topic links above the list to open one topic, or type a word in the search box. Search and topic filters cover the full article collection.
04Where do the facts in the articles come from?
Articles draw on public sources such as CISA advisories, MITRE ATT&CK and ENISA reports. Sources are listed at the end of an article when it cites them.
05How do I get new articles by email or feed?
The site feed at brandefense.io/feed/ lists new posts. The email sign-up box is on the All Resources and Reports pages.
06What does Brandefense do?
Brandefense is an AI-driven threat intelligence company. Its platform covers cyber threat intelligence, digital risk protection and external attack surface management. You can request a demo from the Request A Demo page.
07How many articles are on the Brandefense blog?
This collection currently contains 528 public articles. The page shows the total at the top and the count for each topic next to its name. Each article shows its publish date.
08Who writes the Brandefense blog?
The blog describes its articles as explained by the analysts who track threats. They cover threat actors, dark web activity, ransomware and digital risk. The newest articles appear first.
09Does the blog have articles about APT groups?
Yes. The Knowledge Hub also holds profiles of threat groups. Use the topic links or article search to explore the coverage.
10What is the difference between the deep web, the dark web and the surface web?
The surface web is the part of the internet that search engines list. The deep web is content that search engines do not list, such as pages behind a login. The dark web needs special software to reach.
Stay Ahead of Digital Threats.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.