DORA, the EU’s Digital Operational Resilience Act, has been directly applicable law since 17 January 2025, and its testing requirements are where most financial firms run into trouble first. The regulation sets up two genuinely different testing obligations under one name, and conflating them is the single most common mistake we see: basic ICT testing that applies to nearly every in-scope entity every year, and Threat-Led Penetration Testing (TLPT), a far heavier, specialised exercise that only a defined subset of firms ever has to run. This guide separates the two clearly, explains exactly who has to do what, and walks through what a TLPT engagement actually involves phase by phase.

Read More

Ask most Cyprus businesses which sectors get real cybersecurity scrutiny from regulators, and the answer is almost always “banks and investment firms.” That stopped being accurate a while ago. Between MiCA, the National Betting Authority’s licensing regime, IMO shipping cyber requirements, and the Central Bank of Cyprus’s oversight of electronic money institutions, several sectors that used to sit outside financial-grade regulation are now squarely inside it, each with its own testing expectations that a generic vulnerability scan does not come close to covering.

This guide covers what each of these sectors actually needs tested, why the risk profile is different from a standard business website, and what “in scope” really means if you operate a crypto platform, an iGaming site, a shipping company, or an EMI out of Cyprus.

Read More

If you run a Cyprus Investment Firm, a bank, an insurer, or any other regulated financial business on the island, you are very likely staring at three overlapping cybersecurity obligations right now: DORA, NIS2, and CySEC’s own ICT risk circulars. Each one has its own legal basis, its own regulator, and its own idea of what “tested” actually means. None of them is satisfied by an annual vulnerability scan, and confusing the three, or assuming one covers the others, is the single most common compliance gap we see when we scope a penetration test for a Cyprus financial firm.

This guide walks through what each framework actually requires, who is in scope, how often testing has to happen, and what a penetration test that satisfies DORA, NIS2, and CySEC actually looks like in practice.

Read More

In the ever-evolving landscape of cybersecurity threats, attackers continuously develop innovative methods to conceal malicious code from detection systems and security analysts. The latest addition to this arsenal is InvisibleJS, an open-source obfuscation tool that leverages zero-width Unicode characters to hide executable JavaScript code in files that appear completely empty. This sophisticated steganography technique represents a concerning evolution in code obfuscation methods, with significant implications for web application security, malware distribution, and threat detection.

The Apache Logging Services team has recently disclosed a critical security vulnerability in Apache Log4j Core that puts enterprise applications at significant risk of data interception. This latest security flaw, tracked as CVE-2025-68161, affects the widely-used logging framework and creates opportunities for sophisticated man-in-the-middle attacks targeting sensitive log data. For organizations relying on Log4j for application logging, understanding this vulnerability and implementing proper security measures is paramount.

MITRE has released its 2025 Common Weakness Enumeration (CWE) Top 25 Most Dangerous Software Weaknesses list, revealing the root causes behind 39,080 Common Vulnerability and Exposure (CVE) records this year. These prevalent flaws enable attackers to seize system control, steal sensitive data, or cripple applications. Organizations must prioritize remediation of these weaknesses to protect their digital assets and maintain security posture in an increasingly hostile threat landscape.

CVE-2025-64775 & CVE-2025-66675: Understanding and Mitigating the Multipart Request Processing Flaw

The Django Software Foundation has released emergency security patches addressing two significant vulnerabilities affecting all supported versions of the popular Python web framework. These flaws, ranging from high to moderate severity, could enable attackers to execute SQL injection attacks against PostgreSQL databases or launch denial-of-service attacks that crash application servers through resource exhaustion.