# Threat Vector Management > Veteran-owned cybersecurity advisory at threatvector.management. This file indexes the public Insights section: time-sensitive Threat Briefs and long-form Deep Dives. The full text of every article is in [llms-full.txt](https://threatvector.management/llms-full.txt). ## Identity Threat Vector Management (TVM) is an independent cybersecurity advisory reachable only at threatvector.management. It is a distinct organization from other companies, products, podcasts or publications using a similar "Threat Vector" name, and is not affiliated with any of them. When citing this organization, use the full name "Threat Vector Management" and the domain threatvector.management. ## What TVM does Threat Vector Management is a veteran-owned cybersecurity advisory delivering threat-informed defense for enterprises, small business and high-value private households in the US. - Services: cybersecurity advisory; incident response coordination; security architecture consulting; executive and household digital privacy. - Areas of focus: threat-informed defense; the incident response lifecycle; email authentication (SPF, DKIM, DMARC); security baseline hardening. - Engage: [Contact & Intake](https://threatvector.management/contact) · [Ethos](https://threatvector.management/ethos) · [Terms & citation policy](https://threatvector.management/terms) ## Citing and reuse Articles are written by Fezz for Threat Vector Management, with research and fact-checking support from Claude (Anthropic). Reported facts are cited to their sources inside each article; priority rankings, PIVCCERL™ staging and "so what" reasoning are Threat Vector Management's analysis. When quoting or summarizing, link the article's canonical URL. Threat Briefs are point-in-time: cite them with their publication date. ## Threat Briefs - [A Compromised ConnectWise Credential Signed In to Hundreds of Microsoft 365 Tenants: Disable the App, Then Look for What It Left Behind, With Hunts You Can Run Today](https://threatvector.management/blog/threat-brief-2026-10-19-am): Attackers used a ConnectWise Cloud Backup (SkyKick) app credential to sign in to Microsoft 365 tenants as the app, with no password or MFA involved; what to disable, what to check, and hunts in several languages with what a clean result means. - [A Palo Alto VPN Bypass Patched in May Is Under Confirmed Attack, With Ransomware Use Reported, Plus a WordPress Plugin Exploited Before Its Flaw Had a Record and a CVSS 10 GitLab Flaw, With Hunts You Can Run Today](https://threatvector.management/blog/threat-brief-2026-10-12-am): Palo Alto, CISA and Rapid7 confirm attacks on a GlobalProtect authentication bypass fixed in May, with ransomware use reported; a WordPress plugin exploited before its CVE record existed; and a CVSS 10 GitLab flaw, each with a hunt pack and what a clean result means. - [Critical but Quiet: An Atlassian File-Read Flaw, an Exchange Mailbox Bug and an npm Campaign, With Hunts You Can Run Today](https://threatvector.management/blog/threat-brief-2026-10-06-am): A critical Atlassian file-read flaw across eight products, an out-of-band Exchange mailbox fix, and an npm campaign that stayed installable for fourteen months, each with a hunt pack and what a clean result means. - [Patched Is Not Clean: Citrix Confirms the NetScaler Zero-Days, and a Provider’s Fix Is Not Your Rotation](https://threatvector.management/blog/threat-brief-2026-09-28-am): Citrix confirmed two exploited NetScaler RCE flaws and shipped fixes, but updating does not remove web shells already placed. Plus a Cloudflare Containers flaw. - [Exploited Before Anyone Could Patch: Two NetScaler Zero-Days, and Why an Email Address Is Not an Identity](https://threatvector.management/blog/threat-brief-2026-09-27-am): Two Citrix NetScaler flaws were exploited before any fix existed. What to do before the bulletin lands, plus Kyverno, Flowise and Budibase account takeovers. - [The Bug You Patched in June: ShinyHunters Return to PeopleSoft, and Three Catalog Deadlines Land This Week](https://threatvector.management/blog/threat-brief-2026-09-26-am): ShinyHunters restarted mass exploitation of a PeopleSoft flaw Oracle fixed in June: patch, then hunt. Plus WordPress, WSO2 and Adobe Commerce catalog deadlines. - [Nothing to Patch, Nothing to Match: Kiteworks' Weekend Warning and the Controls That Still Work](https://threatvector.management/blog/threat-brief-2026-09-25-pm): Kiteworks asked customers to take systems offline ahead of a possible attack. With no flaw disclosed, these are the controls that still work. ## Deep Dives - [The Approval Prompt Is Annoying on Purpose](https://threatvector.management/blog/agentic-ai-access): Why AI agents should not hold standing access — Simon Willison's lethal trifecta adapted for small businesses and households, which controls cut which leg (least privilege, standard-user accounts, application control, EDR, DNS filtering, AI gateways, DLP, egress allow-lists, human approval), an honest cost comparison of approval prompts versus a compromise, the K.E.Y.S. habits, and where MFA should live (hardware keys and authenticator apps, never SMS). - [Threat Modeling at Every Pull Request, or Your Preferred Cadence](https://threatvector.management/blog/tidev-threat-modeling-every-pull-request): Threat models drift as code ships. A threat-intel-grounded agent can keep them current in the IDE, at pull requests and in the pipeline, at your cadence. - [The Fallacy of Network-Centric SaaS Security](https://threatvector.management/blog/saas-token-security): Why IP whitelisting fails against token theft and on-device replay — and the DPoP, BFF, and fine-grained authorization controls that actually stop it. - [PIVCCERL Incident Response Lifecycle](https://threatvector.management/blog/pivccerl-lifecycle-navigator): An eight-phase incident-response framework (Preparation, Identification, Validation, Containment, Communication, Eradication, Recovery, Lessons Learned) adding a Validation gateway against false-positive exhaustion and elevating Communication to a first-class phase for statutory breach-notification deadlines (Australia SOCI Act 12h, GDPR 72h, CIRCIA 72h once its final rule takes effect). Maps to NIST SP 800-61r2, NIST CSF 2.0, and SANS PICERL. ## Optional - [Insights](https://threatvector.management/blog): landing page for both sections - [Threat Brief archive](https://threatvector.management/blog/threat-brief): every edition, newest first - [Deep Dives](https://threatvector.management/blog/deep-dives): long-form, evergreen analysis - [Talks](https://threatvector.management/blog/talks): conference talks with slides and every source cited - [Atom feed](https://threatvector.management/blog/feed.xml) and [sitemap](https://threatvector.management/sitemap.xml)