The VITI Security Blog
Practical writing on managed IT + cybersecurity.
By the engineers doing the work - not a marketing team summarizing it. We write when we have something to say, not when the calendar says we should.
vCISO vs. Full-Time CISO: When a Part-Time Security Lead is Enough
Deciding between a vCISO and a full-time CISO for your growing company depends on your current risk, compliance needs, and internal resources. A part-time vCISO often provides the strategic leadership and expertise necessary without the overhead of a dedicated executive role.
VMware ESX Zero-Day: China-Linked APT Exploits CVE-2026-41709 to Hide Traces
A critical zero-day vulnerability (CVE-2026-41709) in VMware ESX is being actively exploited by a China-linked threat actor to bypass logging. Small and mid-sized businesses running affected VMware products must patch immediately.
FTC Safeguards Rule & MFA for Tax Preparers: Compliance and Rollout
The FTC Safeguards Rule explicitly mandates multi-factor authentication (MFA) for tax preparers accessing client data. This post details where MFA is required and offers a practical guide for implementation.
Oracle PeopleSoft CVE-2026-35273: ShinyHunters Zero-Day Attack Advisory
A critical zero-day vulnerability chain in Oracle PeopleSoft CVE-2026-35273 is being exploited by ShinyHunters. Learn how to patch and protect your environment.
Building Your Regulation S-P Incident Response Program
Chief Compliance Officers: Understand the concrete requirements for building an incident response program under the updated Regulation S-P. This guide focuses on actionable steps and critical controls.
PHP2Shell Critical RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Exploited
Two critical remote code execution (RCE) vulnerabilities, collectively known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), are now actively exploited in the wild. If your business runs PHP versions 8.2.* before 8.2.35, 8.3.* before 8.3.36, 8.4.* before 8.4.27, or 8.5.* before 8.5.12, immediate patching is required.
VAPT Cost in India: What Drives Quotes and a Fair Scope
Understand VAPT costs in India. This guide for CTOs covers factors driving quotes, fair scope definition, and how to get real value from your next VAPT assessment.
ISO 27001 Gap Analysis: What It Covers, How Long It Takes, and What You Get
An ISO 27001 gap analysis is the foundational step for certification, identifying precisely where your current information security management system stands against the standard's requirements. It covers all 114 controls across 14 Annex A clauses and clauses 4-10, providing a clear roadmap.
WISP Templates vs. Custom Plans: What IRS and FTC Actually Look For
For tax preparers and small CPA firms, a generic WISP template is rarely sufficient to meet IRS and FTC compliance requirements. True security and regulatory adherence demand a custom Written Information Security Plan tailored to your firm's specific operations and risks.