Field notes from Common Defense on social engineering, communication-channel attacks, and the defenses we build to stop them.
Scammers now reach people on every channel they use for work: email, voice, text, WhatsApp, and Telegram. Nearly every major breach starts the same way, with a message or call that looks legitimate on a channel the company already trusts. Here's how it happens, and what we built to stop it.
Read article →
Application security asks whether the code is correct. For most of the last three years, the losses answered a different question.
In March 2026, attackers took over the npm account behind axios, a JavaScript library that's pulled around 100 million times a week. Every step looked legitimate, right up until a prompt in a meeting asked the maintainer to install an update. Here's how it happened.
