Cybersecurity Blog

Dynamic Application Security Testing Illustration

Dynamic Application Security Testing (DAST): Working Principals, Benefits, and Limitations

08/09/2026

Many development teams rely on static code analysis and manual reviews. While these are important components of secure software development, they cannot cover every security risk. Vulnerabilities do not arise solely from the source code itself; they can also emerge from component interactions at runtime, or from deployment configurations, dependencies, or runtime behavior – factors that cannot be fully captured by static analysis.

Coding Illustration on security risks through race conditions

Race Conditions – Why Temporal Concurrency Can Lead to Real Security and Business Risks

26/08/2026

Race conditions arise when two or more processes access the same resource simultaneously and the result depends on the order in which the operations occur. For example, two parallel requests can redeem the same coupon if both check its status as “not yet used” before either request records the redemption in the database.

False Trust – The Invisible Security Risks in Confidential Computing

09/07/2026

Taking advantage of Software-as-a-Service (SaaS) without losing control over sensitive data is a longstanding dream. Companies often rely on third-party providers to protect their most sensitive data or workloads. However, this leads to compliance and trust issues. SaaS models based on confidential computing promise to resolve this conflict: Companies should be able to take advantage of the flexibility of SaaS without compromising the confidentiality of their data.

ransomware-group-anonymous-hackers-illustration

BravoX: New Ransomware Threat in the DACH Region

29/06/2026

The ransomware landscape is constantly changing. New groups emerge, while old ones disappear or reorganize. However, only a few of these new players manage to establish themselves within a short period of time. One such group is BravoX, which first appeared publicly in early 2026 and was involved in several incidents shortly thereafter – including cyberattacks that we at Oneconsult had the privilege to handle.

swiss-national-flag-above-federal-palace-bern

The EU Cyber Resilience Act (CRA): What Swiss Companies Need to Know

02/06/2026

It’s Tuesday morning. Your robot vacuum is quietly doing its rounds while you’re in a meeting – a perfectly ordinary situation that you don’t give a second thought to. After all, it’s just a device, a little convenience. To an attacker, however, this very robot vacuum isn’t just an everyday helper – it’s a gateway into your network. It is precisely this scenario that has EU lawmakers concerned, which is why they drafted the Cyber Resilience Act (CRA). This law also applies to Swiss companies that sell, import, or distribute products with digital elements throughout the EU.

AI Agent Security: Threats and Attack Vectors

20/05/2026

Artificial intelligence (AI) has advanced rapidly in recent years. While in 2023 it still consisted mainly of simple chatbots – with OpenAI’s ChatGPT being the prime example – it has evolved into an ecosystem of highly complex, autonomous systems. Today, companies are deploying AI applications across various business areas: from intelligent customer support chatbots and retrieval augmented generation (RAG) systems to fully autonomous AI agents that independently plan tasks, access tools, and make decisions.

mobile-application-cybersecurity-pentest

Improving the Security of Mobile Applications With Pentests According to MASVS

09/04/2026

Mobile applications have become an integral part of our daily lives and are growing increasingly important for businesses, especially in industries that handle highly sensitive data. A recent example from the banking sector illustrates this clearly: Over 10 % of the Swiss population now uses neo banks (linked page in German) – banks that typically interact with their customers exclusively through a single mobile application.

Security Operations Center (SOC): Planning, Setup, and Operation

10/03/2026

The IT systems of modern companies are highly connected, distributed, and dynamic. Cloud services, SaaS applications, home office, different locations, and external partners expand digital value creation – but also increase the attack surface. Consequently, the number and complexity of cyberattacks are increasing, as are regulatory requirements and expectations for rapid response capabilities.

Implementing Incident Response Management Successfully: 6 Decisive Success Factors

24/02/2026

Cyberattacks are on the rise – and they no longer only affect large corporations. Small and medium-sized enterprises (SMEs) are also increasingly becoming the target of cybercriminals. In the event of an emergency, a lack of processes, unclear responsibilities, or insufficient preparation often lead to delays, unnecessarily high costs, and considerable reputational damage.

Incident Response Management: Why it Will Become Mandatory in 2026

24/02/2026

What was considered unlikely just a few years ago is a reality today: the majority of companies have already been affected by cyberattacks, many of them successfully. The question is therefore no longer whether a security incident will occur, but when it will happen and how resilient your company will be in responding to it through professional incident response management (IRM).

Kerberoasting Made Easy – Efficient Methods for Hash Cracking

11/12/2025

It has now been over ten years since Tim Medin introduced the so-called Kerberoasting attacks. And even today, Kerberoasting remains a reliable attack technique against Microsoft Active Directory, which is often exploited by penetration testers and red teamers. With a valid domain account, the attack can be carried out in an Active Directory environment without extended privileges. Afterwards, an attempt can calmly be made to crack the passwords of service accounts offline.

New Critical IBM AIX NIM Fixes Released: CVE-2025-36251, CVE-2025-36250, CVE-2025-36096, and CVE-2025-36236

18/11/2025

IBM has addressed newly discovered critical vulnerabilities in AIX Network Installation Manager (NIM) with the release of security patches, following responsible disclosure by Oneconsult’s security research team.

What’s the Buzz With Post-Quantum Cryptography and Should You Care?

17/11/2025

Over the course of 2025, virtually everyone (in IT) started talking about Post-Quantum Cryptography (PQC) and the Q-Day. In this article, we will cut through the headlines, explain to you what all this is about, and provide recommendations on how to deal with it.

Windows 11 Hardening With Intune: Methods and Recommendations for a Secure Environment

28/10/2025

The end of support for Windows 10 on 14 October 2025 has (hopefully) prompted many companies to migrate to Windows 11. In this context, it would also make sense to switch the device management to Microsoft Intune and manage the Windows 11 hardening policies there as well. With a properly configured hardening baseline, the attack surface of Windows systems can be significantly reduced.

Password Spraying: Procedure, Risks, and Protective Measures

09/09/2025

Password spraying and credential stuffing are among the most common methods used by attackers to gain unauthorized access to company systems. Compared to classical brute-force attacks, password spraying attacks are more difficult to detect. They deliberately exploit the human weakness for easy-to-remember passwords. In this article, we explain how these attacks work, what risks they pose, and what measures companies can take to protect themselves effectively.

Erhöhen Sie Ihre Cyber-Resilienz durch Purple Teaming

Purple Teaming: How to Strengthen Your Organization’s Cyber Resilience With Attack Simulations

11/08/2025

Purple teaming refers to the close cooperation between attacking (red team) and defending (blue team) security forces. Instead of acting independently, they jointly develop targeted attack scenarios, carry them out together, and analyze the results in direct exchange. This collaborative approach not only allows for vulnerabilities to be uncovered more efficiently but also addresses them directly with appropriate defensive measures.

Analyzing Bitcoin Addresses: How to Detect Cyber Fraud Early On

01/07/2025

Whether it’s threatened DDoS attacks, data leaks, or sextortion scams – cybercriminals often demand payment via Bitcoin wallet addresses. It’s the (supposed) anonymity of cryptocurrency that makes it particularly attractive for extortion attempts.

PDF Phishing: How To Protect Yourself Effectively

12/06/2025

Did you know that PDF files often serve as a gateway for cyberattacks? These seemingly harmless documents can be infected with dangerous viruses that damage to your computer without you realizing it – so called PDF phishing. Viruses often hide in PDF files to exploit security vulnerabilities and steal your sensitive data.

Perfect 10: Discovery of Critical IBM AIX NIM Vulnerabilities (CVE-2024-56346 & CVE-2024-56347)

05/05/2025

During a recent penetration test of an IBM AIX environment, I uncovered two critical vulnerabilities, including one that had gone unnoticed for almost 30 years. The identified flaws in the AIX Network Installation Manager (NIM) allow for remote command execution with root privileges — potentially compromising entire AIX infrastructures. In this blog post, I will walk you through the discovery of CVE-2024-56346 and CVE-2024-56347, the impact of these vulnerabilities, and the steps you should take to secure your systems.

cybersecurity-awareness-als-wichtiger-teil-des-isms-oneconsult

Cybersecurity Awareness as an Essential Part of Information Security

14/04/2025

In today’s cybersecurity threat landscape, it is no longer sufficient to rely on technical measures alone to ensure a company’s information security. From an organizational point of view, clear responsibilities and processes, as well as continuous testing of all these activities, are also required. Yet for cybersecurity, people are often the most vulnerable to attacks and this is precisely where cybersecurity awareness comes in: to train employees to recognize cyberattacks at an early stage and therefore to minimize the risks they pose to the company. This article explains why cybersecurity awareness is a central component of any Information Security Management System (ISMS), how organizations can benefit from appropriate awareness measures, and how important the engagement of top management is in this regard.