Cyberpedia

The sound of keystrokes, the noise of a power supply or an open microphone can reveal what you type or say, with nothing showing on the screen.

A fake sign-in site relays your password and MFA code live, then the attacker steals the session. How it works and how to protect yourself.

A USB cable or drive can pose as a keyboard and type commands on your behalf. Here is how to protect yourself.

How an attacker tests thousands of passwords, online or on a stolen database, and what an employee sees and can do about it.

How an attacker takes over a work mailbox or spoofs a known sender, and how to check a payment request before acting on it.

A fake "I'm not a robot" check gets you to paste a command into Windows+R. How ClickFix works, how to spot it and what to do if you ran it.

Passwords stolen in a data breach are tried by bots on other services. How the attack works and how to protect yourself.

A booby-trapped site or message can make your browser act for you on a service where you are logged in. Here is the mechanism and the defenses.

How thousands of hijacked machines overwhelm a service, what employees notice on screen, and the organisation's reflexes.

How someone left alone for a few minutes with a laptop in a hotel room can compromise it, and what to do about it.

A rogue mobile base station can sit between your phone and the network. What the sources say about this risk, and what you can do.

A booby-trapped USB device or port can infect a phone or computer. What the victim sees and the reflexes to adopt.

An app installed outside the official stores can steal passwords and SMS messages. What employees see, how it works, what to do.

A contactless access badge can be copied or relayed without its holder noticing. What is known, what you see and what to do.

A fake IT support person who calls or writes to get a password: how pretexting works and how to defuse it.

A booby-trapped QR code hides its address inside an image and leads to a fake login page. How to spot it and what to do before scanning.

Rowhammer alters a device's DRAM memory without touching it directly. What an employee sees, how it works and which habits help.

A stolen session cookie lets an attacker pass for an employee without a password or second factor. How it works, a real case, reflexes.

Spectre and Meltdown: how malicious code reads secrets through the processor, with nothing shown on screen, and how to protect yourself.

Spear-phishing is an email personalised with public information about you and your company. How to spot it.

An unknown, polite person enters behind you or with your consent. What employees see, how physical access fails, and the reflexes to adopt.

How an attacker registers a domain close to a brand's to steal your credentials, and how to spot the booby-trapped address.

A fake IT support agent or a fake banker calls you and the screen shows a familiar number: how to recognise vishing and react.

A site you visit every week can be booby-trapped. How a watering hole attack works, what you can see, and the habits that protect you.

Intimidating message, quoted password, threat to publish: what the sources say about phishing and social engineering, and the reflexes.

What the sources say about AI-assisted impersonation of an executive by call or message: what the employee sees, the mechanism, the controls.

The March 2017 Apache Struts flaw (CVE-2017-5638): how an exposed server with an outdated component can be taken over, and what an employee does.

What the sources say about Pegasus on iPhone: exploited flaws, Apple's September 2021 fixes and simple habits for employees.

In March 2024, malicious code is found in XZ Utils 5.6.0 and 5.6.1. What the CISA alert says, and what an employee can do.

The company directory decides who is who and who can access what. What employees do, what the administrator does, and the pitfalls.

BGP tells networks where to send traffic. Its weaknesses (hijacks, leaks) and the RPKI safeguard, explained for employees.

DNS links a site name to its address, and nobody sees it happen. Why attackers target it, and what an employee does.

Decoy server, fake document, fake access key: what security decoys are, and what an employee should do on coming across one.

What an IP address tells others about an organization, what it does not, IPv4 and IPv6, and the steps an employee can take.

A JWT is the credential an application hands you after you sign in. What its signature checks, the pitfalls, and the habits to adopt.

Least privilege limits rights to what is strictly needed, Just-In-Time access grants them for a limited time. What employees do.

Splitting a network into zones (VLANs, internal firewalls, micro-segmentation) limits ransomware. What employees do to make it hold.

How OAuth 2.0 gives an application limited access to your account without your password, and how to read the consent screen.

Penetration test, simulated attack exercise, defence teams: what these terms mean and what to do if you see suspicious behaviour.

An administrator account opens every door. Here is how PAM protects it and what employees and their managers do day to day.

How SCIM creates, changes and disables application accounts when you join, change roles or leave, and what you need to do.

Why company computers must share the same time, what employees do, and the pitfalls of a misconfigured time server.

One account opens several applications through a token. What SAML and OpenID Connect do, and what employees can do about the traps.

How Tor and onion routing work, and why an employee should not install Tor on a work computer without the IT department's approval.

How a password manager encrypts your vault from the master password, and what you do so that it really protects your accounts.

An AI agent calls tools on your behalf: mail, files, APIs. What it can get wrong, and how to limit its rights.

A language model predicts the probable word without checking that it is true: it can invent facts, references and code packages.

Pasting a contract into an online AI translator exposes its content. What CNIL, OWASP and NIST say, and what employees do.

Why an AI assistant goes along with you, how that skews its answers, and simple habits to avoid mistaking its agreement for proof.

An AI repeats the stereotypes in its training data while looking neutral. What employees check, and what the AI Act provides.

How C2PA and Content Credentials attach a signed history to an image, video or sound, and what that signature does and does not prove.

A generative AI can state false facts with confidence. How to spot the claims to check and compare them against three independent sources.

An instruction typed into the chat can sometimes make an AI assistant break its rules: mechanism, on-screen signs, dated cases, prevention.

An AI assistant predicts text; it neither understands nor feels anything. What employees should draw from this for their data, checks and caution.

How to guide an AI assistant with two or three examples, then split a task into steps checked one by one, without exposing data.

Retraining a model (fine-tuning, LoRA) or giving it documents to consult (RAG): the difference, the risks and your reflexes.

An AI assistant such as ChatGPT writes plausible text that nobody has checked. What this changes for your answers, your data and your rules.

An AI agent can prepare an action, but some must be approved by a person. What the employee reads, accepts or refuses.

An email, a web page or a PDF can hide instructions that an AI carries out on your behalf. How the attack works and how to protect yourself.

An AI assistant can invent believable court rulings. Why it happens, and how to check a citation before using it at work.

A language model reads text fragments, not sentences. What this means for an employee, and the security pitfalls.

How AIs trained on AI-written text lose diversity, and how to check generated content before using it at work.

An attacker who queries an AI can guess whether a document was used to train it, or even bring out memorized excerpts.

On-device AI (NPU chip) and cloud AI raise different questions: choosing an approved tool, what to enter, and whom to tell.

An open-weights model or an online service: what it changes for company data, and what employees should do or avoid.

Pretraining, fine-tuning, RLHF and DPO: the stages of building an AI assistant and what they change for how you use it at work.

How an AI answers from internal documents, how to check its citations and which pitfalls to expect: leaks, booby-trapped files, errors.

A fraudster can take on an executive's face and voice in a video call. What the sources say, and the check that protects you.

How AI models that reason step by step work, when to use them at work, and why their answers always need checking.

Transcribing a meeting or call with AI: what the tool does with your voice, what to check beforehand, and what the GDPR and the CNIL say.

A language model can answer the same question differently. What temperature, Top-p and Top-k control, and what you do about it.

The Transformer, described in June 2017: what the attention-based architecture changes for an employee, its limits and prompt injection.

An AI search engine shows links next to its answer. Here is how to open them, compare them with the claim, and know when not to rely on them.

Structure an instruction to a generative AI with the ACTIF method, protect company data and check every answer before using it.

A fake bank advisor calls, talks about fraud and asks for a code. How to recognise the call, what to do on the spot and afterwards.

Writing to several external recipients without exposing their addresses: the Bcc reflex, common pitfalls and what to do after a mistake.

A supplier or an executive demands new bank details or an urgent transfer: call them back on a number you already have, then get the request approved.

Shared Wi-Fi, curious neighbours, strangers asking questions: the risks of a coworking space and the reflexes an employee needs.

Enterprise password manager versus the browser's built-in one: what sets them apart, what employees do and the pitfalls to avoid.

A person without a badge on the premises may be preparing an intrusion or plugging in a rigged device. The polite reflex: walk them to reception.

What a social media post reveals about an employee's workplace and habits, and the steps that limit this exposure.

A data breach puts your password in circulation. How to react at once, and why an address missing from a database proves nothing.

Cameras, speakers and connected TVs can open a door into your network. Here is how to set them up and keep them apart from work.

How a leak from a personal site can open your work account, and how to prevent it: one password per account, a password manager, two-step login.

An unknown person in technician's clothes, a door held open out of politeness: how social engineering gets into premises, and what to do.

Turn on two-factor authentication for your personal email: methods, backup codes, forwarding rules to check and pitfalls to know.

An urgent security update only protects once installed. What to do on notification, and how to spot fake updates.

Acquisition, fundraising, audit: how to spot the fake links, fake transfers and fake contacts that target a data room.

What ANSSI qualifications (SecNumCloud, PASSI, PRIS, PDIS) are for, and what they change for employees and for management.

US laws can open access to data hosted in Europe. What the GDPR says, what the EU-US framework changes, and SecNumCloud.

What cyber insurance assumes of employees and management: offline backups, multifactor authentication, first steps and reporting.

EU Regulation 2024/2847 sets cybersecurity rules for makers of digital products: what it changes for you as an employee.

What the NIS 2 Directive asks of organisations and their managers, what it changes for each employee, and where the law stands in France.

Why a single annual training session falls short: what ENISA, NIST, the NCSC and CISA say about designing and measuring awareness programmes.

The EU AI Act sorts uses of AI into four risk levels and requires employers to build their staff's AI literacy.

What a vital operator is, what the 2013 military programming law (LPM) requires of it, and what NIS 2 changes.

What an information security management system (ISMS) changes for an employee and for management, with NIST and NCSC resources.

ISO/IEC 42001 and AI at work: what the sources say about the EU regulation, the NIST framework and guidance for employees.

Why training seen only once is not enough, and what NIST, ENISA and the NCSC say about continuous awareness.

The NIST Cybersecurity Framework 2.0, published in February 2024: its six functions and what it changes for employees and management.