What your company needs to know about cybersecurity
One email a week covering the vulnerabilities that actually affect European businesses, the compliance deadlines coming up, and one concrete action you can take the same day. Written by the team doing the offensive work, not by a content department.
What you get every week
One email, five fixed sections. No recycled headlines and no filler to justify the send.
- The vulnerabilities that actually reach you: We don't publish every CVE of the week: we filter for what genuinely shows up in a mid-sized European company's stack, with a call on whether a public exploit exists and whether it warrants patching now or can wait for the normal cycle.
- What we're seeing in audits: A real pattern from our offensive work over recent weeks, anonymised and generalised. What failed, how it chained, and what would have cut it. This is the part you will not find in a news feed.
- Compliance countdown: NIS2, DORA, CRA, ENS, AI Act. Which deadline is approaching, exactly who it binds, and what needs to be ready before it lands. No alarmism and none of the vagueness of generic legal summaries.
- One action for this week: Something concrete and bounded you can review or ship in under an hour: a setting, a check, a permission worth revoking. Actionable the same day you read it.
- Recommended reading: One report, investigation or technical guide worth your time, with the reason we picked it. One, not ten.
Why this newsletter and not another
Because most cybersecurity newsletters repackage the same international news two days late. This one is written by OSCP-certified people who break into companies with their permission and see first-hand what actually fails: which misconfigurations keep recurring, which plugin is still unpatched across half the market, and what an auditor really asks for when they sit down in front of you.
That perspective changes the filter. A critical vulnerability in a product almost nobody here runs is useless to you. A default misconfiguration in Microsoft 365 that we found in half of last quarter’s audits is not.
Who it is for, and who it is not for
It will help if you are
- A CTO, CISO or IT lead holding the company’s security
- A technical founder in SaaS, fintech, e-commerce or healthtech
- A compliance lead at an entity in scope of NIS2, DORA or the ENS
- An agency or consultancy with corporate clients in your care
It will not help if you want
- General technology news or headlines about famous breaches
- Beginner content along the lines of "what is a firewall"
- Home or personal security guidance
Frequently asked questions
Why do you ask for a work address?
Because the content assumes a company context and works better when it lands in the inbox where you make professional decisions. It also keeps the list clean and the metrics honest. It is not a wall: it is the audience it is written for. If you work for yourself and the content fits, write to us and we will add you anyway.
How often do you send?
Once a week. If a given week has nothing worth your attention, we skip it. We would rather miss a send than spend five minutes of your time on filler.
What do you do with my email address?
It is stored in our management system to send you the newsletter, and for nothing else. We do not share or sell it. You can unsubscribe from the link in every issue and exercise your access, rectification and erasure rights at any time.
Is this an excuse to sell me something?
The newsletter is technical content, not a disguised sales sequence. We mention our services when they are relevant and no more than that. If it ever turns into a catalogue, you will unsubscribe, and rightly so.
Can I see an issue before subscribing?
The resources published on our site are written to the same standard and in the same voice as the newsletter. If you find those useful, you will find the newsletter useful.
Attackers are already reading this
The window between an exploit going public and being used at scale is measured in days, sometimes hours. What separates the companies that get there in time from the ones that find out through an incident is rarely budget: it is knowing sooner. One email a week.