https://shadowmap.com/blog/ ShadowMap research on external attack surfaces, data exposure, digital threats and the security decisions that follow from them. en-IN Sat, 14 Nov 2026 22:33:31 GMT https://shadowmap.com/blog/php2shell-industrial-devices-wago-exposure/ https://shadowmap.com/blog/php2shell-industrial-devices-wago-exposure/ Thu, 05 Nov 2026 16:05:41 GMT ShadowMap Research WAGO's advisory changes where teams should look for PHP exposure. Use a device-level evidence record to separate a reachable web interface from a confirmed vulnerable deployment. https://shadowmap.com/blog/emudhra-ca-key-compromise-vendor-risk/ https://shadowmap.com/blog/emudhra-ca-key-compromise-vendor-risk/ Wed, 21 Oct 2026 06:39:18 GMT Yash K Eight compromised eMudhra intermediate CA keys exposed a trust dependency beyond browsers. How to review client updates, certificate chains and CA ownership without confusing key compromise with proven misuse. https://shadowmap.com/blog/what-a-security-rating-does-not-tell-you/ https://shadowmap.com/blog/what-a-security-rating-does-not-tell-you/ Wed, 29 Jul 2026 04:00:00 GMT ShadowMap Research A security rating compresses your external posture into a single letter. Four things the grade structurally cannot see, and how to use it as an index rather than an outcome. https://shadowmap.com/blog/source-code-leak-what-an-attacker-gets/ https://shadowmap.com/blog/source-code-leak-what-an-attacker-gets/ Tue, 21 Jul 2026 04:00:00 GMT ShadowMap Research The code is rarely the fastest thing in a leaked repository. What an attacker actually takes is the endpoints, the secrets and the architecture. Finding those in the noise is the whole job. https://shadowmap.com/blog/switching-exposure-vendors-first-30-days/ https://shadowmap.com/blog/switching-exposure-vendors-first-30-days/ Tue, 07 Jul 2026 04:00:00 GMT ShadowMap Research Replacing a digital risk protection or attack surface vendor is a data-migration project, not a procurement one. What to export, what to insist on, and what will look like a regression in week one. https://shadowmap.com/blog/digital-risk-protection-is-being-absorbed/ https://shadowmap.com/blog/digital-risk-protection-is-being-absorbed/ Tue, 23 Jun 2026 04:00:00 GMT ShadowMap Research Search demand for digital risk protection is receding while the problem itself grows. What the category got right, what it never covered, and what replaces it. https://shadowmap.com/blog/easm-caasm-vulnerability-exposure-management/ https://shadowmap.com/blog/easm-caasm-vulnerability-exposure-management/ Tue, 09 Jun 2026 04:00:00 GMT ShadowMap Research Four acronyms compete for the same budget line, and they are not interchangeable. The difference is architectural, and one question separates them: where does the data actually come from? https://shadowmap.com/blog/reconstructing-a-compromised-device/ https://shadowmap.com/blog/reconstructing-a-compromised-device/ Wed, 27 May 2026 04:00:00 GMT ShadowMap Research A password is one row; a device is a story. The seven artefact classes in a stealer log, what each one tells you that the password does not, and the response that follows from each. https://shadowmap.com/blog/validating-external-exposure-bas-pentest-cart/ https://shadowmap.com/blog/validating-external-exposure-bas-pentest-cart/ Wed, 13 May 2026 04:00:00 GMT ShadowMap Research Breach and attack simulation, autonomous pentesting, continuous penetration testing and CART all promise proof. What each one validates, and the part of the external surface it cannot see. https://shadowmap.com/blog/stealer-logs-vs-combolists/ https://shadowmap.com/blog/stealer-logs-vs-combolists/ Wed, 29 Apr 2026 04:00:00 GMT ShadowMap Research A credential-exposure report shows two identical-looking rows. One is a resold combolist entry worth almost nothing; the other is an infostealer capture from a live device, and an active incident. https://shadowmap.com/blog/scoping-a-14-day-exposure-poc/ https://shadowmap.com/blog/scoping-a-14-day-exposure-poc/ Tue, 21 Apr 2026 04:00:00 GMT ShadowMap Research External exposure POCs usually test features that were never in doubt. What fourteen days can settle is whether a platform's picture of your organisation is correct, and how to measure that. https://shadowmap.com/blog/prioritising-exposure-you-cannot-patch/ https://shadowmap.com/blog/prioritising-exposure-you-cannot-patch/ Tue, 07 Apr 2026 04:00:00 GMT ShadowMap Research A leaked key, a typosquat, a vendor's weak posture, a credential in someone's browser: none of these has a CVE. Prioritising them needs a different method from vulnerability management. https://shadowmap.com/blog/leaked-credentials-that-still-work/ https://shadowmap.com/blog/leaked-credentials-that-still-work/ Tue, 24 Mar 2026 04:00:00 GMT ShadowMap Research Credential exposure is not a volume problem. What a stealer log actually contains, how a leaked credential gets tested, and why the handful that still authenticate are the only ones that matter. https://shadowmap.com/blog/external-half-of-ctem/ https://shadowmap.com/blog/external-half-of-ctem/ Tue, 10 Mar 2026 04:00:00 GMT ShadowMap Research Every published treatment of continuous threat exposure management assumes agents and internal scope. Here is what the five stages look like from the outside, where an attacker actually starts. https://shadowmap.com/blog/zhenhua-data-investigation/ https://shadowmap.com/blog/zhenhua-data-investigation/ Thu, 17 Sep 2020 04:00:00 GMT Yash K Our investigation of Zhenhua Data with a detailed look at their operation and how the Chinese Intelligence Firm leverages public and private data sources to create actionable intelligence about a wide range of targets.