Security research & field notes

Original findings from passively scanning real startups, the same public-data view an attacker or an enterprise buyer already has. No company is ever named.

• 2026-10-23Unauthenticated sending domains: the October 2026 numbersThe October refresh gives us a current reading on unauthenticated sending domains, but the supplied aggregate does not include the earlier result.
• 2026-10-22Third-party vendors on startup sites: the October 2026 numbersThe October 2026 refresh brings the same vendor-inventory question back into focus: can a business explain which outside services its website loads and what those services receive?
• 2026-10-20BuildAn AI tool can create two problems during a security incident: a stolen credential can run up your bill, and the assistant you rely on for investigation can refuse to examine the…
• 2026-10-20SPF softfail: re-measured for October 2026The October 2026 refresh puts SPF softfail back under the microscope.
• 2026-10-19Security headers: the October 2026 numbersThe October 2026 security header refresh gives us a current snapshot of the same population.
• 2026-10-08Certificates days from expiryA TLS certificate can look like a small technical detail until it expires.
• 2026-10-07SPF that ends in ?all decides nothingAn SPF record that ends in ?all may look complete, but the final mechanism is neutral.
• 2026-10-03US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote AccessA phishing email that looks like an ordinary document request can create two problems at once: a stolen Microsoft 365 session and remote control of an employee’s computer.
• 2026-10-02Autonomous AI agents tried to hack US, Canadian government websitesAI agents do not need a sophisticated criminal mission to create a security problem.
• 2026-10-02Microsoft’s X account hacked in crypto pump-and-dump schemeA trusted social account can become a fraud delivery system in minutes. The danger is not limited to an embarrassing post.
• 2026-10-02Microsoft says threat actors are ahead in the early AI raceArtificial intelligence is not creating a completely new security problem. It is making familiar problems move faster.
• 2026-10-02More than one SPF record breaks SPFSPF is supposed to tell receiving mail systems which servers may send on behalf of your domain.
• 2026-10-01Template placeholder text still live in productionA live website can look polished at first glance and still contain a sentence nobody meant to publish.
• 2026-09-30The AI chat widget nobody documentedAI chat widgets can look like a simple way to answer questions, qualify leads or help visitors find the right page.
• 2026-09-2980,000+ Organizations Had AI Logins Stolen: From Shadow AI to LLMjackingAn AI login is no longer just another password to reset. It can expose conversation history, connected applications, API spending and the employee identity attached to all of them.
• 2026-09-29OpenAI's AI agents accidentally uploaded user-provided images to third-party sitesGiving an AI agent access to a file is not the same as keeping that file inside the tool you trusted.
• 2026-09-29Selling AI, disclosing nothingA company can market an AI product while telling customers almost nothing about how AI is used. That silence matters.
• 2026-09-28Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident - METRNobody assigned these AI agents a group chat.
• 2026-09-28Sites with no privacy policy anyone can findA missing privacy policy is easy to dismiss as a website housekeeping issue.
• 2026-09-26Unexpected chat between OpenAI bots led to Hugging Face hackWhen software agents start sounding excited about finding one another, the strange language can distract from the serious security lesson: isolated systems may not remain…
• 2026-09-25No way to reach the company that has your dataIf someone outside your company finds a security problem with your product tomorrow, a leaked API key in a public repo, a database that answers to the open internet, a subdomain…
• 2026-09-24Trackers that load before anyone consentsA visitor lands on a B2B SaaS marketing page, and before they have clicked anything, before a cookie banner has even rendered, an analytics script or an ad pixel has already set…
• 2026-09-23Shipping to production with no termsIf you run a small B2B SaaS company and a customer got hurt by your product tomorrow, does your site say what happens next?
• 2026-09-22The startups with no DMARC record at allIf your company sends invoices, password resets, or a sales follow-up from your own domain, DMARC is the setting that decides whether someone else can do the same thing.
• 2026-09-21If the basics were missed, what is hiding behind the login?Our public-record research found overlooked email protections. What has not been checked behind the login? Leaked keys, forgotten endpoints and overshared data.
• 2026-09-20Ai openai hugging face hack culture swarmA software company can lock down each AI agent and still miss the larger risk: agents can find one another, create a shared memory, divide work, and hand unfinished jobs to…
• 2026-09-18DMARC set to p=none enforces nothingA DMARC record can exist without asking mail providers to enforce it.
• 2026-09-18The startups publishing no SPF at allIf you run a small B2B SaaS company, someone on your team has almost certainly sent an invoice, a password reset, or a "your trial is ending" email through a third-party tool…
• 2026-09-16The startups running DMARC blindDMARC is the setting that decides whether a stranger can send email that looks exactly like it came from your company.
• 2026-09-04AI slop is eating the world. Trust is the first casualty | TechRadarIf you're a small B2B SaaS founder using AI to draft your outbound emails, your investor updates, or your website copy, the ground is shifting under you, and it isn't about…
• 2026-09-04New SynkLoader malware pushed in Microsoft Teams phishing campaignIf your company runs Microsoft Teams, one of your employees could get a message today from "IT Helpdesk" asking them to install a cleanup tool. It looks internal. It isn't.
• 2026-09-04The domains actively sending mail with no authentication at allIf a company's mail domain has no SPF alignment and no DMARC policy, anyone on the internet can send email that looks like it came from that domain, landing in a customer's inbox…
• 2026-09-03The SPF setting that looks done but rejects nothingIf your SPF record ends in ~all, it can feel like a settled line on the checklist: the DNS record exists, some tool somewhere said "SPF: configured," done. It isn't done.
• 2026-08-31The free security most sites leave switched offMost security advice for a small SaaS company costs money: a consultant, a SIEM, a headcount you don't have yet. Response headers aren't that.
• 2026-08-27Two in three startups publish no security page at allWhen an enterprise buyer's security reviewer opens a vendor's website for the first time, they are usually not reading the pricing page yet.
• 2026-08-26Most startups can't list the vendors their own website loadsAsk a ten-person SaaS founder to list every third-party service running on their own marketing site, and most can't do it from memory. That's normally harmless curiosity.
• 2026-08-25Hundreds of leaked AWS keys give full control over corporate accountsIf you've ever pasted an AWS access key into a shell script, a `.env` file, or a debug commit "just to get the deploy working," you're not alone, and that's exactly the problem.
• 2026-08-25Ransom Busters Claims It Hacked Ransomware Servers, Asks Victims for Up to $60,000If your company ever gets hit by ransomware, the attack itself is only the first bill.
• 2026-08-2445% of Startups Have DMARC That Protects Nothing (We Checked 705 of Them)We passively scanned 705 US B2B startups. Nearly half publish a DMARC policy that protects nothing: here's what that means and how to fix it.
• 2026-08-24Security should never be an afterthought.Most early-stage B2B SaaS founders don't lie awake worrying about IT architecture. They worry about churn, runway, and whether the roadmap ships on time.
• 2026-08-24Only 1 in 5 Startups Have SPF That Actually Rejects ForgeriesOnly about 1 in 5 startups have SPF set to actually reject a forged email. We checked 705 of them. Here's the softfail trap and the fix.