Blog

Practical knowledge from operations: IT security, compliance and infrastructure for mid-sized companies – written by the people who build it.

Since January 2026 · New articles appear regularly

  1. 10/01/2026Keycloak Security Update: Upgrade to 26.7.5 or LaterKeycloak 26.7.4 and 26.7.5 close a series of vulnerabilities, including a privilege escalation via the impersonation role. Target: 26.7.5 or later.
  2. 09/30/2026Firewall Rules as Code: The Migration TrapMoving host firewall rules to a new mechanism can silently lose them during clean-up. How that happens and which order of steps is safe.
  3. 09/30/2026The Approval Nobody SeesAn approval can work exactly as planned and still wait unnoticed for a long time. Why waiting states in automation and AI agents need to be monitored.
  4. 09/30/2026Least Privilege Is on the Label, Not on the HostAccounts are deemed minimally privileged, yet the host often allows far more. How to check real permissions and why it takes a negative probe.
  5. 09/30/2026NIS-2 Registration: Deadline Passed – What Applies NowThe NIS-2 registration deadline has passed. How to check whether you are affected, register late – and why the real work only begins afterwards.
  6. 09/30/2026A Check That Was Never Red Is Not a CheckWhy a check needs four outcomes, how health checks and search queries quietly give the all-clear – and why every new check has to fail once.
  7. 09/10/2026AI Agents in IT Operations: Rules by ReachAI agents in operations need rules based on reach, not on trust. Five principles for approvals, rollback paths and protective mechanisms.
  8. 09/07/2026NetScaler ADC and Gateway: BSI Reports Active ExploitationTwo flaws in NetScaler ADC and Gateway, including an authentication bypass; the BSI reports active exploitation. Who is affected and which builds help.
  9. 09/06/2026Security incidentBerlin State Network: What Lay Between All-Clear and LeakOn 19 August Berlin reported that nothing sensitive had leaked. On 4 September the data set was online. What lies in between – and what follows from it.
  10. 09/06/2026CRA Reporting from 11 September: What Must Be in PlaceOn 11 September 2026 Article 14 CRA takes effect – for the entire installed base too. Who it hits, what starts the 24-hour clock, and what must be ready.
  11. 09/06/2026SonicWall SMA1000: Critical Flaws, Actively ExploitedTwo vulnerabilities in SonicWall SMA1000, one rated CVSS 10.0, are being actively exploited. Affected versions, the hotfixes – and why patching alone is not enough.
  12. 09/06/2026TerminalFix: When Employees Paste the Attack ThemselvesGermany's BSI warns about the TerminalFix campaign. A fake CAPTCHA gets staff to paste a PowerShell command – and what remains is a tunnel into the network.
  13. 08/18/2026Security incidentWhen the District Grinds to a Halt: Why Municipalities Become TargetsIn mid-2026 it hit the Rhein-Nahe municipal association and waste disposal in the Kassel district. Two cases – and what really decides how such an attack ends.
  14. 08/13/2026EU AI Act: What Applies to Your Company Since August 2026Since August 2, 2026, the AI Act transparency obligations apply; GPAI obligations since 2025. What to do now, what the Omnibus postponed, and where the fines lie.
  15. 08/12/2026Cloud Repatriation: When Moving Back In-House Pays OffFor steady loads, the public cloud bill can exceed on-prem TCO. How to run the return trip cleanly – and the hybrid alternative.
  16. 08/11/2026VMware Licensing Costs Under Broadcom: Proxmox as an Alternative – Soberly AssessedSubscription lock-in, portfolio consolidation, price jumps: when a switch from VMware to Proxmox VE pays off – and when VMware should stay.
  17. 08/09/2026Public AI or Your Own Model? The Right MixSovereign AI does not mean forgoing the cloud, but placing every model in the right spot: plan in public, execute locally – steered through a governed gateway.
  18. 08/08/2026AI on Your Data Is a Security Task: Why RAG Systems Leak DataRAG lets a language model answer over internal documents. Built poorly, it hands out content no one should see. The fix is classic security.
  19. 08/07/2026Servers in Your Own House, Security from the Data CenterMany mid-market workloads belong on premises – but a single site is vulnerable. How a hybrid DR bridge connects both sides.
  20. 08/06/2026Before Copilot Searches Your File Store: Clean Up PermissionsMicrosoft 365 Copilot shows everyone exactly what they already have technical access to. In grown tenants, that is often more than assumed. What to do first.
  21. 08/01/2026NIS-2 Is Now Live: What Companies Must Catch Up OnNIS-2 has applied since December 2025, and the BSI grace period is ending. What affected companies should now catch up on: registration, obligations, liability.
  22. 07/31/2026Cyber Resilience Act: Reporting Obligation from September 11, 2026From September 11, 2026, the CRA reporting obligation applies to manufacturers of digital products. Key dates, deadlines, and a five-step readiness check.
  23. 07/30/2026Cisco FMC: Hardcoded Account Under Active Exploitation (CVE-2026-20316)CVE-2026-20316 in Cisco Secure Firewall Management Center is being actively exploited. Why the CVSS score is misleading and what operators should do now.
  24. 07/21/2026Windows 10: The Free Extension Does Not Apply to BusinessesThe free Windows 10 year until 2027 applies only to consumers. For businesses, the first ESU year ends in October 2026 – the options in overview.
  25. 07/17/2026When the Firewall Patches Itself: FortiOS UpgradesFortiOS updates itself automatically, in certain cases even by force. What triggers the upgrades, which exceptions apply and how you can take control.
  26. 07/14/2026TISAX 2027: What the New VDA ISA Catalog Means for SuppliersVDA ISA2027 applies to all TISAX assessments ordered from January 1, 2027. What changes – and how suppliers choose the assessment timing strategically.
  27. 07/07/2026When the Attack Comes Through Your Service ProviderYour own IT can be spotless—and everything still goes down because your provider was hit. Why supply-chain risk is underestimated, and what NIS-2 requires.
  28. 06/23/2026Network Segmentation for Mid-Sized Businesses: Start Small, Big EffectA flat network turns every break-in into a total loss. Why segmentation is the single most effective measure—and how to begin without a major project.
  29. 06/09/2026Cisco SD-WAN Under Fire: Zero-Day Wave by UAT-8616For months, zero-days in Cisco Catalyst SD-WAN Manager and Controller have been actively exploited. What operators should patch and check now.
  30. 05/20/2026PAN-OS in May 2026: Two Vulnerabilities, One Actively ExploitedTwo PAN-OS flaws in May 2026: root RCE via the Captive Portal and a GlobalProtect auth bypass. Who is affected and which hardening matters now.
  31. 05/12/2026ISO 27001 for Mid-Sized Companies: A Realistic Way InFrom the BSI CyberRisikoCheck to the certificate: how mid-sized companies can approach ISO 27001 in stages – without overreach and without detours.
  32. 04/28/2026What a NOC Really Delivers—and What It Doesn'tA Network Operations Center sounds like something only large corporations run. What actually sits behind it, why it matters for SMEs, and where the honest limits lie.
  33. 04/14/2026DORA Affects Your IT Provider Too: Registers and ContractsRegister of information as an annual routine, contractual clauses under Art. 30, new oversight of ICT providers: what financial entities and MSPs need to know.
  34. 03/31/2026F5 BIG-IP APM: CVE-2025-53521 Actively Exploited for Pre-Auth RCEThe F5 flaw CVE-2025-53521, reported as a DoS in October 2025, has been reclassified as pre-auth RCE and is being actively exploited. What operators must do now.
  35. 03/17/2026Aruba AOS-CX: Admin Password Reset Without Login – CVE-2026-23813A critical flaw in AOS-CX web management allows an admin password reset without authentication. No exploitation known yet – why you should still patch now.
  36. 03/10/2026Immutable Backups: Why 3-2-1 Is No Longer EnoughIn 89% of ransomware cases, attackers targeted the backups. What 3-2-1-1-0 means, how immutability works – and what belongs in the emergency plan.
  37. 02/18/2026The First 60 Minutes After a Ransomware DiscoveryWhat matters in the first hour after you find encrypted files—and what to leave alone. A level-headed procedure for SMEs, before panic turns into mistakes.
  38. 02/04/2026950 Ransomware Attacks, 80% on SMEs: Lessons for Mid-Sized CompaniesThe BSI-Lagebericht 2025 and Bitkom figures show: ransomware hits SMEs above all. Three controls decide the outcome – soberly assessed.
  39. 01/20/2026Municipal Procurement in NRW: The Value Thresholds Are GoneSince 1 January 2026 no state-level value thresholds apply to municipal procurement in NRW. What that means for IT purchasing – and which obligations remain.
  40. 01/13/2026IT Security Is a Board Matter by Law: § 38 BSIG for Managing Directors§ 38 BSIG holds management personally accountable: implementation, oversight, training. What that means – and which evidence now counts.
  41. 01/06/2026Review of 2025: The Year the Firewalls Themselves Became the TargetFortinet, Cisco, Juniper, F5: in 2025, attackers systematically targeted firewalls, VPN gateways, and management layers. A review with lessons.

Questions about any of these topics?

Let's talk.+49 212 240915 0