Identity security
How can a session be stolen after MFA?
MFA can succeed while an attacker captures a usable session. Learn which evidence separates a successful sign-in from authorized activity.
Read guide →CYBERTAP FIELD GUIDES
Learn to reason from evidence.
Short explanations of the concepts behind our simulated investigations. Read a guide, then make the call yourself.
Identity security
Password spraying vs. brute force: what does the evidence show?
Learn the difference between one password across many accounts and many guesses against one account, and how to scope a sign-in alert.
Read guide →Identity security
What is device-code phishing?
Understand the legitimate device authorization flow, how social engineering can misuse it, and what to examine in sign-in logs.
Read guide →Cloud security
Cloud exposure vs. compromise: what can you actually claim?
A public cloud configuration increases risk. Determine whether an outside party could reach it, did reach it, or accessed data.
Read guide →