Channi Greenwall

BreachForums has been down since April 15th, and the chatter is getting intense. Lots of fake Telegram channels, domains, and platforms popping up, claiming to be the real deal. We're also seeing threat actors discuss the FBI's potential strategy of keeping the site offline to flush out the real operators amidst all this noise. Cyberint (now Check Point) is actively crawling and monitoring every new source that emerges. While many claim official status, we're verifying each one. Currently, the forum has not officially resumed activity. Here’s a summarized list of the most discussed domains: breachforums[.]st The site seems to be back online, with a PGP message claiming the forum was taken down because of a possible infiltration by law enforcement using a MyBB 0day. breachforums[.]sx Same address, different suffix. Claims to be the backup forum of the original “.st” It was launched on April 27th, but there is no mention of this domain on any official group. Site is online and looks like the original forum. breached[.]fi This site is an alleged continuation of breached forums, that went online on April 23rd, claiming to be the official forum. However, two owners were allegedly arrested, the website’s management credentials were leaked online, and the site’s infrastructure has been offered for sale. The site was crawled until went offline breached[.]ws This is a forum under construction, created by a Threat Actor called Hasan. Hasan aims to re-create the Breached forum with new features, but lacks credibility. The site is currently offline At the moment, the official site (.st) is still offline and it is yet to be determined what is real and official among the alternatives. We assess that law enforcement agencies are involved in some way, and this situation benefits them by allowing them to apprehend more activity and threat actors. Cyberint, now a Check Point Company keeps adding to crawling whatever we identify and we will continue monitoring changes and discussions of any type of source and update accordingly.

101

4 Comments

We've seen it with startups, enterprises, and even critical infrastructure teams—compliance is met, but actual security? That's another story... Over the past year, we've helped dozens of companies hit their compliance goals. SOC 2. ISO 27001. HIPAA. You name it. Most of them came to us with the same request: "We just need to pass the audit. Can you help us get compliant?" And we did. Policies were written, monitoring was turned on, dashboards looked clean, security awareness and everything the auditors wanted to see was in place. But then comes the question no one really prepares for: Now what? Because here's the thing: compliance is a milestone—not the finish line. You can have a beautifully documented monitoring process… and still get breached. One of our clients had everything on paper: a SIEM in place, monitoring configured, and an internal SOC doing the rounds. They were proud of how audit-ready they were—and rightly so. Every box was ticked. Then, the breach happened. Attackers slipped in quietly. No alerts. No alarms. No response. Why? Because the whole setup was designed to look secure—not actually to be safe. It was built to impress auditors, not stop adversaries. That's the difference we always talk about: audit-ready vs. breach-ready. And it's not just a slogan—it's the reason real threats go unnoticed in "compliant" environments... So if you've already done the hard work—built the stack, documented the processes, checked the boxes—don't stop there. Make it real. Make it work when it matters. And if you're in that "now what?" moment—somewhere between the audit and actual security—let's talk! I'm happy to share what we've seen work (and what quietly fails) out there in the real world.

112

12 Comments

People often ask “What does Stern Security's Velocity product do differently?” Here's what I tell them. We don’t just measure internal and third-party risk - we go beyond that by turning risk insights into actionable business decisions including: ☑️ Cyber Cost Optimization – Maximize your security investment. ☑️ Cyber Budget Calculations – Get precise budgeting to meet your security goals. ☑️ Cyber Product & Services Recommendations – Tailored insights based on a company's unique environment There is also a free version that companies can use to measure their baseline security, although it does not include the cost analysis. #securetheplanet #velocity #businessimpact

44

3 Comments

Twingate ships a lot 🚢🚢🚢 Excited to share that the Twingate client now supports fast switching between multiple accounts 🔥 On the surface, it might look like a small feature. In reality, it solves one of the most common patterns we’ve observed from the start: many of you need access to more than one Twingate network. The use cases are everywhere. Engineers often need to jump between staging and production. Remote workers want secure access both to their company network and to their home lab. Contractors and consultants regularly collaborate across multiple organizations and need to switch contexts without friction. Until now, that often meant awkward workarounds or logging in and out. This update makes those transitions seamless. What excites me most is what it says about how people use Twingate. It’s not confined to a single environment. It spreads. People adopt it at work, then bring it home. Or they discover it personally, then advocate for it at their company. That “network effect” (pun intended 😜) is one of the strongest signals of value. And now, with multi-account support, we’ve made that experience dramatically better. A small change in the client, but a big unlock for the way modern teams and individuals really work 😊 🙌 Lior Rozner Eran Kampf Shirley Wu Alexey Lapuka Iwan Protchenko Anton Shkurenko William Katcher Dmitry Bel Anna Liu Andrew R. Harding

57

4 Comments

Is running a cyber startup like a marathon or a sprint? 🏃‍♂️🏃🏾‍♀️ That doesn't really matter 😉. But what does matter is spending time outdoors, accelerating your pulse, taking in the vibrant green landscape, and unleashing those endorphins. ✅ Physical activity isn't just good for your body - it's rocket fuel for your brain. It sharpens focus, ignites creativity, and reduces stress - all essential tools for security practitioners, builders and anyone navigating the high-stress cybersecurity landscape. ✅ The mental clarity you experience on a winding trail or open road often cracks the code to problems that seemed unbreakable at your desk. ✅ And let's be honest: some of the best ideas were born with feet pounding pavement or hands gripping the wheel, not fingers tapping keyboards or during a long Zoom. Now, circling back to our analogy - running a cyber startup demands both marathon endurance and sprint intensity: ➡️ Sometimes you're in full sprint mode: finding the devil in the details, diving deep into tactical execution, shipping at lightning speed, and yes, occasionally micromanaging. ➡️ Other times, you're in the marathon mindset: plotting your long-game strategy, crafting visionary roadmaps, and building with resilience to weather the inevitable storms. Cybersecurity is a race with no finish line. Balancing the intensity of sprints with the mindset of a marathon runner - and making time to be physically active - isn’t just good for your health. It’s also a vital founder hack. In the picture – yours truly at the TLV Marathon finish line. #Cybersecurity #StartupLife #Running #FounderWellness #MentalHealth #Leadership #PhysicalExercise #Innovation #WorkLifeBalance David Warshavski Gregory Ainbinder

77

8 Comments

$5,000 per playbook x 200 security alert types = $1 million just to get started with SOAR. I know of many companies that have spent over a million dollars and do not even have playbooks to triage 200+ alert types - that almost every security team gets. Continuing to use the SOAR product does not work for 95% of the enterprises. AirMDR, Inc.'s agentic AI doesn't need playbooks. It just works out of the box. I've spent five years working with SOAR platforms at large enterprises. Even some of the biggest companies that invested more than a million dollars every year had only 125 playbooks to show for it. Think about that. A small company gets 100 to 200 different kinds of alerts in a single week. You'd need to spend a couple of million dollars just to automate playbooks for 200 different alert types. With agentic AI, you don't have to write any playbooks. The models have gotten so good that, given the correct data and context, you can get AI analysts to triage cases without ever having to document a single playbook. It’s a whole new world of alert triage. SOAR leaves most teams sore. Agentic triage is the better way.

60

1 Comment

Too many founders with compliance requirements still treat cybersecurity like a “big company problem.” You’ll hear things like: “We’re too small, people will understand.” “We don’t have the budget for that yet.” But if your business touches sensitive data—HIPAA, PCI, or anything else— you’re not just taking a risk. You’re violating an expectation. One that regulators, clients, and your future acquirer will not overlook. Cyber requirements aren't an IT line item. They are in fact a regulatory requirement. The cost of getting it wrong goes far beyond ransom payouts or downtime. You’re putting your team, your customers, and your valuation at risk. Boards need to push harder. Founders need to act sooner. Because if you’re waiting until something breaks— you’re not just behind. It is called willful neglect and it can result in much more than a slap on the wrist. #cybersecurity #founders #leadership #riskmanagement #compliance #startups #scaling

21

4 Comments