The VITI Security Blog
Practical writing on managed IT + cybersecurity.
By the engineers doing the work - not a marketing team summarizing it. We write when we have something to say, not when the calendar says we should.
Regulation S-P: Mandating 72-Hour Vendor Breach Notification for RIAs and Broker-Dealers
The amended Regulation S-P now requires RIAs and broker-dealers to ensure their service providers contractually commit to notifying them of data breaches involving customer information within 72 hours. This post breaks down how to implement and enforce this critical contractual provision, ensuring your firm meets its regulatory obligations.
Barracuda Email Security Gateway: Critical Root Access Vulnerabilities (CVE-2026-116606, CVE-2026-111560)
Two critical vulnerabilities in Barracuda Email Security Gateway appliances allow unauthenticated root access without a login. VITI Security advises immediate patching to protect your business's vital email infrastructure.
EASM vs VAPT: Continuous Discovery vs Point-in-Time Test, and When You Need Both
EASM focuses on continuous, broad discovery of your external attack surface, while VAPT provides a deep, targeted security audit at a specific moment. Both are critical for a comprehensive security strategy.
Apple CVE-2024-27834 and CVE-2025-43529 Zero-Days Under Active Attack
CISA warns that Apple vulnerabilities CVE-2024-27834 and CVE-2025-43529 are being actively exploited by threat actors to deliver info-stealing malware. Learn what systems are affected and how to patch immediately.
What to Expect from Your vCISO: First 90-Day Deliverables
Understand the crucial initial deliverables a skilled virtual CISO brings in the first 90 days, from baseline assessments to a strategic security roadmap.
Penetration Testing for Non-Bank Lenders Under the FTC Safeguards Rule
What the FTC Safeguards Rule requires of mortgage brokers, consumer finance companies and other non-bank lenders: an annual penetration test and six-monthly vulnerability assessments, unless you run continuous monitoring, and who is exempt.
What Defines a Quality VAPT Report and Red Flags in Cheap Ones
A good VAPT report delivers specific, actionable intelligence on your security posture, clearly outlining risks and prioritized remediation steps. Cheap reports often provide generic scanner outputs lacking crucial human analysis and context.
WordPress Core Flaw CVE-2026-119977: Urgent Security Advisory for SMBs
CISA has confirmed active exploitation of CVE-2026-119977, a high-severity WordPress Core vulnerability. SMBs running affected WordPress versions must patch immediately, especially during full-package core upgrades, to prevent arbitrary code execution.
FTC Safeguards Rule Risk Assessment Example for a 10-Person CPA Firm
A practical, step-by-step risk assessment example tailored for a 10-person CPA firm to comply with the FTC Safeguards Rule.