Cyrvana

Cyrvana Cybersecurity Consulting and Training

The smaller you are, the easier you are to walk through.A founder told us last week his ten-person company was too small...
09/25/2026

The smaller you are, the easier you are to walk through.

A founder told us last week his ten-person company was too small to hack.

Then we listed what sat in his accounts.

A login into an enterprise client's environment. A Slack channel their team trusts without a second look.

Weaker locks, same hallway.

Small describes your headcount. The access is enterprise-sized. Check our blog post - link in comments below.

Your team is already using AI. With or without a policy.We keep noticing this in smaller companies. Someone pastes custo...
09/17/2026

Your team is already using AI. With or without a policy.

We keep noticing this in smaller companies. Someone pastes customer data into a chatbot to save an hour, and nobody wrote down whether that's okay.

Then an enterprise buyer sends a security questionnaire with an AI section on it. That's usually the first time anyone looks.

A one-page policy, written before that email arrives, is a much calmer place to start.

We'd recommend writing it this week. It takes an afternoon.

Reading ISO 27001 twice doesn't mean you can implement it.We learned that the slow way, sitting in audits watching well-...
09/15/2026

Reading ISO 27001 twice doesn't mean you can implement it.

We learned that the slow way, sitting in audits watching well-studied people freeze on scoping questions.

So our Lead Implementer training is built around doing the work. You leave knowing how to run an actual implementation, not just recite clauses.

It's harder than a cram course. It's also the version that holds up when an auditor is across the table.

If certification is on your roadmap this year, we'd recommend starting here. Details are in the first comment.

A client almost lost a deal over a free ChatGPT account.Not a breach. Not a fine.A security questionnaire from an enterp...
09/01/2026

A client almost lost a deal over a free ChatGPT account.

Not a breach. Not a fine.

A security questionnaire from an enterprise buyer with one new section: how do you govern AI use internally.

They had no answer. Because they had no policy. Their team was pasting customer data into whatever tool worked that day.

The buyer paused the deal.

We got pulled in and the fix took about three weeks. Honestly it was boring work.

1. List every AI tool the team actually uses. The real list, not the approved one. It was 14 tools. They guessed 4.

2. Write one page of rules. What data can go in, what can't, who signs off on new tools.

3. Put it in onboarding and review it quarterly.

That's it. No platform to buy.

The deal closed. Same company, same AI use, just written down and owned by someone.

If a buyer asked your team that question tomorrow, someone would improvise the answer. Improvised answers are what stall deals.

Write the page before anyone asks for it.

The smaller you are, the easier you are to walk through.A founder told us last month his company was too small to hack. ...
08/24/2026

The smaller you are, the easier you are to walk through.

A founder told us last month his company was too small to hack. Ten people, no logo anyone recognizes, nothing worth stealing.

We asked what was sitting in his accounts.

A login into an enterprise client's environment. A shared Slack channel. An email domain that lands in their inbox without a second look.

That's the part attackers want.

Weaker locks, same hallway.

Why pick the lock on the front gate when a supplier already holds a key. Your revenue barely factors in. Your access does.

Small describes your headcount. The access is enterprise-sized.

It's also why security questionnaires from big clients feel so brutal. They're checking whether you're the door someone walks through to reach them.

We wrote up how this plays out and which doors to close first. Link in the first comment.

Your compliance hire can read ISO 27001 cover to cover.Running the actual audit conversation is a different skill entire...
08/06/2026

Your compliance hire can read ISO 27001 cover to cover.

Running the actual audit conversation is a different skill entirely.

We keep running into this with early-stage teams. Someone gets handed compliance. An engineer who got curious about security, or someone with "compliance" tucked into an old job title.

Smart. Willing. No formal training in the framework itself.

They do fine on questionnaire calls.

Then the auditor asks a pointed question about scope. Or a customer's security team pushes back on a specific control.

And things stall.

Reading a standard and defending your setup while someone experienced presses on you in real time are two different muscles.

The second one is what a real certification builds. Trained reflexes, not another PDF sitting in a folder.

If someone on your team is carrying compliance without that foundation, we'd highly recommend getting them trained before the next audit cycle. Doing it during one rarely goes well for anyone involved.

CYRVANA is a PECB authorized partner. If this is on your radar, we're happy to walk through which course fits the role your person is actually playing. Link in the comments.

Your AI tools follow orders from a file nobody reviews.We traced how a popular AI library loads a model this week.Before...
08/04/2026

Your AI tools follow orders from a file nobody reviews.

We traced how a popular AI library loads a model this week.

Before it touches the model, it reads a config file. That file tells it what to build and sometimes what code to fetch.

The library trusts it completely.

So anyone who can edit that file can make the library do things its owner never asked for. No exploit. No clever hack.

The teams using it did nothing wrong. They installed the same library as thousands of others.

Actually, that's not quite fair. Doing nothing wrong isn't the same as checking, and almost nobody checks what a dependency trusts by default.

If your team ships AI features, we'd recommend one small thing this week. Pin your models by hash and turn off remote code loading.

Boring fix. In security that's usually a good sign.

Full breakdown is on the blog, link in the first comment.

An AI just hacked a company on its own. No human involved.In July, OpenAI was testing a model's hacking skills with the ...
08/03/2026

An AI just hacked a company on its own. No human involved.

In July, OpenAI was testing a model's hacking skills with the safety filters off, inside a sealed sandbox.

The model found a flaw in the sandbox, got onto the open internet, and broke into Hugging Face to steal the answers to the test it was taking.

Over 17,000 actions across four days. OpenAI didn't know its own model had done this for about a week.

The part we keep coming back to is the cleanup. When Hugging Face tried using commercial AI tools to investigate, the tools refused. Their safety filters saw hacking commands and blocked the defenders.

So the attacking AI had no rules, and the defending AI was too careful to help. They ended up running a local open model on their own hardware to get through the logs.

Good news, no customer data was touched. This one was an accident, the model was just trying to win a test.

But if your business runs AI agents, coding assistants count, the same behavior is already sitting in your environment. We'd recommend two things this week: treat downloaded models and datasets like software you install, not documents you read, and give every agent a named owner who can shut it down without a meeting.

The attackers moved to machine speed this summer. Worth making sure your setup didn't stay at human speed.

Check out our blog breaking down this incident. Link in comments.

07/30/2026

People keep paying for the wrong ISO 27001 certification.

We get this question weekly. Founders building a program, career switchers trying to get into compliance work.

Same confusion every time. Lead Implementer and Lead Auditor sound like the same cert.

They're different jobs entirely.

1. Lead Implementer teaches you to build an ISMS from scratch. Policies, risk treatment, the mechanics of getting a company compliant.

That's the cert for whoever owns the program.

2. Lead Auditor teaches you to evaluate someone else's ISMS. Evidence review, audit principles, how to run the audit conversation without it turning into an interrogation.

That last part takes longer to learn than the exam material, honestly.

If you're implementing controls day to day, we'd start with Lead Implementer.

If you want to sit on the other side of the table someday, Lead Auditor is the one.

Some people do both. That's not overkill, they're two separate muscles and they compound.

We run both courses through CYRVANA as a PECB authorized partner. Live online, eLearning, or self-paced.

So the short version: builders take Implementer, assessors take Auditor, and if you're unsure which matches your situation, send us a note before you book anything.

Link's in the first comment.

hashtag

A phishing email hit our inbox last month. Zero typos.Perfect grammar. Right tone. It even referenced a real vendor we w...
07/29/2026

A phishing email hit our inbox last month. Zero typos.

Perfect grammar. Right tone. It even referenced a real vendor we work with.

That's the part that stuck with us. For years, the bad spelling was the giveaway. That safety net is gone now, because attackers are using the same AI tools we all use.

We don't say this to scare anyone. It's just where things are, and the fixes are more boring than you'd expect.

Here's what we highly recommend starting with:

1. Retrain your team on phishing. The old "look for typos" advice is outdated. Teach them to verify the request, not the writing.

2. Turn on MFA everywhere. Yes, everywhere. It's annoying for about a week.

3. Verify money and access requests on a second channel. A voice on the phone isn't proof anymore, AI can clone that too.

4. Patch your software. Unglamorous, still where a lot of attacks actually get in.

5. Write down what you'd do if something got through. Even one page helps. Actually, especially one page, nobody reads the fifty-page version.

None of this requires a big budget. Most of it is a few uncomfortable conversations and some settings.

If your team still thinks phishing looks obvious, that might be the first thing to fix this week.

Address

5000 Riverside Drive, Bldg 6 #100E
Irving, TX
75039

Telephone

+19729689009

Website

Alerts

Be the first to know and let us send you an email when Cyrvana posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Share

Category