CyberPulse

CyberPulse We are leaders in the space of Governance, Risk and Compliance (GRC), security advisory, consulting and pe*******on testing.

We partner in your Cybersecurity journey!!

The 90-day password reset is still in most security policies we read, and NIST withdrew the advice that put it there.NIS...
05/10/2026

The 90-day password reset is still in most security policies we read, and NIST withdrew the advice that put it there.

NIST Special Publication 800-63B removed mandatory periodic password changes. Not because rotation is harmless, but because forcing it every quarter produces Spring2026, then Summer2026, or the same password reused somewhere that does not check. Change a password when there is evidence of compromise, not on a calendar.

The rest follows the same logic. Length and uniqueness beat arbitrary complexity rules. Screen new passwords against breached password lists so one already in circulation cannot be set. Retire knowledge-based questions, because a mother's maiden name is not a secret.

Updating the policy costs nothing. Then pair it with phishing-resistant MFA, because password quality alone was never going to carry the account.
Resources
Full guide: https://www.cyberpulse.com.au/2025/02/13/nist-changes-approach-to-passwords/
Book a 30-minute call: https://www.cyberpulse.com.au/get-in-touch/

Privileged access rollouts rarely fail on the technology. They fail on the accounts nobody remembers creating.Service ac...
04/10/2026

Privileged access rollouts rarely fail on the technology. They fail on the accounts nobody remembers creating.

Service accounts, scheduled tasks and application identities hold standing admin rights with no named owner. Rotate one of those credentials without knowing what depends on it and something in production stops working, which is how the whole programme gets a reputation for breaking things.

The Verizon 2025 Data Breach Investigations Report found credential abuse was the single leading way breaches began, at 22% of cases.

Four things to settle before you shortlist a platform. Discover every privileged account, human and non-human. Rank them by the damage a compromise would do. Name an owner for the platform and the access reviews. Secure executive sponsorship, because privileged users will route around anything slower than the old way.

It is also the most direct route to the Essential Eight mitigation "restrict administrative privileges". Start with discovery, not procurement.
Resources
Full guide: https://www.cyberpulse.com.au/2025/02/13/preparing-for-your-pam-roll-out/
Free Essential Eight self-assessment: https://www.cyberpulse.com.au/essential-8-compliance-australia/ -the-assessment
Book a 30-minute call: https://www.cyberpulse.com.au/get-in-touch/

Microsoft has reported phishing emails that dress up a real remote management tool as a Zoom installer, meeting invite o...
03/10/2026

Microsoft has reported phishing emails that dress up a real remote management tool as a Zoom installer, meeting invite or PDF update. One click and an approval prompt later, the attacker can control the device and adds ScreenConnect as a second way in.

Worth asking your IT provider this week: which remote access tools are approved here, and is everything else blocked?

IRAP turns up as one line in a government tender and quietly rewrites the delivery plan. Here is what it asks for.An IRA...
01/10/2026

IRAP turns up as one line in a government tender and quietly rewrites the delivery plan. Here is what it asks for.

An IRAP assessment is an independent evaluation by an ASD-registered assessor, checking your system against the Information Security Manual before it handles government information at PROTECTED or above.

Three things surprise people. The assessor cannot help you remediate, because independence rules prevent it. You pick your own assessor from the ASD public register, since ASD does not assign one. And Essential Eight is only the floor: most PROTECTED assessments work through 150 to 250 applicable controls depending on scope.

Plan for three to five days on site, four to eight weeks of remediation for most organisations, and certification valid for two to three years.

Do the internal gap analysis first. It is the cheapest phase, and it sets up everything after it.
Resources
Full guide: https://www.cyberpulse.com.au/2026/02/06/blog-irap-assessment-australia-guide/
Free IRAP readiness guide: https://www.cyberpulse.com.au/irap-assessment-advisory-services-australia/ -the-guide
Book a 30-minute call: https://www.cyberpulse.com.au/get-in-touch/

Two ISO 27001 terms that get used interchangeably, and should not be.A gap analysis runs before your ISMS exists. It mea...
01/10/2026

Two ISO 27001 terms that get used interchangeably, and should not be.

A gap analysis runs before your ISMS exists. It measures where you actually stand against ISO/IEC 27001:2022, Clauses 4 to 10 and the 93 Annex A controls, and gives you a prioritised roadmap. It is in no clause of the standard.

An internal audit is a Clause 9.2 requirement. It runs once the ISMS is operating, usually three to six months before Stage 2, and confirms the system works as documented. Your certification body looks at that evidence at Stage 1.

A gap analysis tells you what to build. An internal audit confirms that what you built is working. Treating one as the other is a common reason organisations stumble at Stage 2.

One number from the ASD Annual Cyber Threat Report 2024-25 is worth more than most of the coverage around it. ASD respon...
30/09/2026

One number from the ASD Annual Cyber Threat Report 2024-25 is worth more than most of the coverage around it. ASD responded to 138 ransomware incidents last financial year, and the ACSC detected 39% of them itself rather than the affected organisation reporting in.

In more than a third of those cases, the organisation was not the first to know. The same report records more than 1,200 incidents ASD responded to, an 11% increase, and 84,700 cybercrime reports, roughly one every six minutes.

Prevention gets funded because it is easy to specify. Detection gets deferred because nothing visibly breaks while it is missing.

So ask two questions this quarter. If an intrusion started on a Friday night, who sees the alert before Monday? And are the logs that would tell you being kept anywhere your team can search?
Resources
Full guide: https://www.cyberpulse.com.au/2025/10/21/asd-cyber-threat-report-2025-australia/
Book a 30-minute call: https://www.cyberpulse.com.au/get-in-touch/

The 2026 Verizon Data Breach Investigations Report puts software vulnerability exploitation first among the ways attacke...
30/09/2026

The 2026 Verizon Data Breach Investigations Report puts software vulnerability exploitation first among the ways attackers get in, at 31% of breaches, with ransomware present in 48%.

In practice that means the edge of your network: VPN concentrators, firewalls, file transfer appliances, and the remote access tool nobody has patched since it went in. Know what of yours is internet-facing, patch those devices on a shorter clock than everything else, and test the exposure rather than assuming a scanner covered it.

ASD's ACSC has warned that attackers are getting into organisations' AI services using stolen API keys, session tokens a...
30/09/2026

ASD's ACSC has warned that attackers are getting into organisations' AI services using stolen API keys, session tokens and supplier access, then using them to run up paid credits and disrupt work.

If your team or a supplier uses AI tools through an API, ask three questions this week: who owns each key, where is it stored, and is there a spending limit that actually stops usage?

Building a chatbot or an AI assistant? Prompt injection is the first risk to get across. The OWASP Top 10 for LLM Applic...
29/09/2026

Building a chatbot or an AI assistant? Prompt injection is the first risk to get across. The OWASP Top 10 for LLM Applications 2025 ranks it LLM01, top of the list.

The part teams miss is that nobody has to type the malicious instruction. It can sit inside a document your assistant reads, a page it retrieves, or a ticket it summarises. The model follows it, and anything the model can reach is now reachable.

The defences are familiar: least privilege for every tool the model can call, validation of retrieved content and not just user input, human approval before consequential actions, and adversarial testing before and after release.

Password managers are one of the better controls most organisations have. They are also worth treating as an attack surf...
29/09/2026

Password managers are one of the better controls most organisations have. They are also worth treating as an attack surface.

Researchers have demonstrated a DOM-based clickjacking technique against password manager browser extensions, including Bitwarden, 1Password and LastPass. The vault encryption holds. What gives way is the click: an invisible overlay sits over a malicious page, so dismissing what looks like a banner quietly approves an autofill and hands over credentials or one-time codes.

Three settings take most of the risk out. Turn off automatic autofill so filling needs a deliberate click. Limit the extension to the sites that need it. Require phishing-resistant MFA, such as a FIDO2 key, to unlock the vault.

Then ask for password manager abuse to be included in your next pe*******on test, so you find out how your own configuration behaves.
Resources
Full guide: https://www.cyberpulse.com.au/2025/08/28/password-managers-under-attack-the-rise-of-clickjacking-exploits-and-how-to-defend-against-them/
Book a 30-minute call: https://www.cyberpulse.com.au/get-in-touch/

Address

11 York Street
Sydney, NSW
2000

Opening Hours

Monday 9am - 5:30pm
Tuesday 9am - 5:30pm
Wednesday 9am - 5:30pm
Thursday 9am - 5:30pm
Friday 9am - 5:30pm

Website

Alerts

Be the first to know and let us send you an email when CyberPulse posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Share

Category