Author
Threat ResQ Technologies
Every Knowledge Center guide is authored and maintained by the Threat ResQ team, drawing on direct VAPT, compliance, and incident response engagement experience. Named individual bylines will appear here once that's introduced.
Threat Intelligence
Ransomware and Data Extortion in 2026: Trends and How to Prepare
Ransomware has become a business with specialised roles, rapid turnover of groups and tools, and pressure tactics beyond encryption. This guide uses the FBI's 2025 report as its factual spine: how many incidents were rep
9 min read
VAPT
Exploitation of Internet-Facing Systems: Why Unpatched Edge Devices Are Now the Top Way In
Most organizations cannot patch everything immediately, and attackers know it. The winning approach is not "patch faster" in general but **know what you expose, rank what is being exploited, and shorten the time to fix t
9 min read
Threat Intelligence
Identity Attacks in 2026: Credential Theft, Session Hijacking and MFA Bypass
Verizon's 2026 Data Breach Investigations Report finds that stolen passwords are now the runner-up to software vulnerabilities as the way breaches begin, and the FBI's 2025 report notes a rise in account takeover (ATO) c
9 min read
Threat Intelligence
AI-Enabled Cyberattacks in 2026: Deepfakes, Synthetic Phishing and Shadow AI
AI has lowered the cost of producing fluent, personalised, error-free messages, cloned voices, and fabricated images and video. That changes one long-standing defensive habit: "this looks and sounds legitimate" is no lon
9 min read
Security Awareness
What Is Human Risk Management? Beyond Security Awareness Training
Attackers target people because people are reachable, trusting, and busy. Phishing and spoofing was the most-reported crime type to the FBI's Internet Crime Complaint Center in 2025, and IBM's 2025 research for India fou
9 min read
Security Awareness
Smishing and Vishing: How to Defend Against Text and Voice Phishing
Email is the best-defended phishing channel, so attackers increasingly use channels with fewer controls. FBI IC3's 2025 report lists tech and customer support fraud at 47,794 complaints and $2,134,675,818 in reported los
8 min read
Compliance
Security Awareness Training Requirements: ISO 27001, PCI DSS, HIPAA and NIST
Training is one of the most commonly audited controls because it is easy to ask for evidence and easy to fail to produce it. This guide summarizes what the main frameworks ask for, what auditors typically test, how to bu
9 min read
Security Awareness
Role-Based Security Awareness Training: Executives, Finance, HR, IT and Developers
A workforce is not one audience. The person who approves payments, the administrator with privileged access, and the developer who handles API keys each have a different attack surface and a different cost of failure. Th
8 min read
Security Awareness
Phishing Simulation Best Practices: How to Run a Program That Changes Behaviour
Phishing and spoofing was the most-reported crime type to the FBI IC3 in 2025, with 191,561 complaints, and phishing was the leading initial attack vector at 18% of breaches in IBM's 2025 India research. Simulation is on
9 min read
Security Awareness
The Human Firewall: What It Means and How to Build One
Attackers go where defences are weakest, and for many organizations that means the people who handle email, payments, and access. Building a human firewall means giving people the knowledge, tools, habits, and motivation
8 min read
Security Awareness
How to Measure Human Cyber Risk: Metrics and KPIs That Matter
Leaders ask whether training is working. The honest answer requires measures that connect to risk. Completion rates show that people attended; they do not show that behaviour changed. This guide sets out a practical meas
8 min read
Security Awareness
Adaptive Security Awareness Training: How Personalised, AI-Driven Learning Works
Traditional awareness training treats a workforce as one audience: the same course, the same quiz, once a year. People forget most of what they learn in a single session, and their needs differ. Adaptive training address
8 min read
Governance, Risk & Compliance
What Is GRC? Governance, Risk and Compliance Explained
Organizations often run governance, risk management, and compliance as separate activities in separate teams, each with its own spreadsheets. The result is duplicated effort, inconsistent evidence, and surprises at audit
9 min read
VAPT
Web Application VAPT: A Complete Guide to Testing Web Application Security
Web applications are exposed to the internet by design, which makes them one of the most common routes into an organization. Automated scanners find known issues quickly but cannot judge whether a flaw is exploitable or
10 min read
VAPT
Network VAPT: How to Identify Security Weaknesses in Enterprise Networks
An enterprise network changes constantly: new servers, forgotten systems, remote access, cloud connections, and old equipment all accumulate exposure. Network VAPT gives a point-in-time view of what an attacker could act
9 min read
VAPT
Mobile Application VAPT: A Complete Security Testing Guide for Android and iOS
Mobile apps differ from web applications in one important way: the code and local data live on a device that the user — or an attacker — controls. Secrets embedded in the app, data stored insecurely on the phone, and tru
9 min read
Governance, Risk & Compliance
SOC as a Service: What a Managed SOC Does and How to Choose a Provider in India
Attackers do not keep office hours, and most organizations cannot economically staff analysts around the clock. A SOC turns the flood of logs and alerts from endpoints, networks, cloud services, and identity systems into
10 min read
VAPT
HTTP Security Headers Explained: What Every Website Should Set
Security headers move some protection from application code to the browser. They are quick to deploy but easy to get wrong: an over-strict policy can break a site, and a long-lived HSTS setting with a certificate problem
9 min read
Compliance
Third-Party and Vendor Risk Management Under the DPDP Act
Most organizations rely on dozens or hundreds of vendors that touch personal data: cloud hosts, SaaS tools, payment processors, marketing platforms, call centers, and consultants. Each is a potential point of failure and
9 min read
Compliance
Significant Data Fiduciary Under the DPDP Act: Who Is Covered and What Changes
Most data fiduciaries must meet the Act's baseline duties. Some are expected to meet more. Whether an organization is an SDF is not self-declared: the Government designates it, considering factors in the Act. This guide
8 min read
Compliance
DPDP Data Retention and Erasure: How Long Can Businesses Keep Personal Data?
Storage limitation — keeping personal data no longer than necessary — is one of the seven principles on which the DPDP Act rests, alongside consent and transparency, purpose limitation, data minimisation, accuracy, secur
9 min read
Compliance
Data Mapping and Records of Processing Under the DPDP Act: Why Spreadsheets Aren't Enough
Most DPDP obligations cannot be met without a data inventory. You cannot notify individuals about purposes you have not listed, respond to an erasure request without knowing where copies are, assess a breach without know
9 min read
Compliance
Data Breach Response Under the DPDP Act: What Businesses Should Prepare For
A breach response is a set of decisions made quickly under pressure: what happened, whose data is affected, who must be told, and what to do about it. Under the DPDP framework, those decisions have legal consequences. Th
9 min read
Compliance
Cross-Border Data Transfers Under the DPDP Act: What Businesses Need to Know
Many Indian organizations send personal data abroad every day: cloud hosting, global SaaS tools, offshore support, group companies, and payment and analytics providers. Under the DPDP framework, the question is not wheth
8 min read
Compliance
DPDP Act Compliance Checklist: What Indian Businesses Need to Do
Compliance with a privacy law is easier when it is broken into concrete tasks with owners. This checklist is organized around what the DPDP Act and Rules ask of a data fiduciary. It is a readiness aid, not legal advice:
10 min read
Compliance
Children's Data Under the DPDP Act: Age Verification and Parental Consent in Practice
Children's data is one of the most heavily protected categories in the DPDP framework, and the age threshold — eighteen — is higher than in many other countries' laws. Any organization with an app, website, school or tut
8 min read
Threat Intelligence
Cybersecurity Trends 2026: What Indian Organizations Should Prepare For
Trend articles often rely on predictions. This one starts from what has been measured. Each trend below is anchored to a cited source, and the actions are practical steps rather than slogans. Statistics come from differe
11 min read
VAPT
API Penetration Testing: How to Find Security Risks in Modern APIs
Modern applications — mobile apps, single-page web apps, partner integrations, and microservices — rely on APIs to move data. Every endpoint is a potential entry point, and APIs often expose more data and more functions
9 min read
Compliance
SEBI CSCRF and VAPT: Requirements for Stock Brokers, Depositories and AMCs
Earlier SEBI guidance on VAPT was issued in separate circulars for stock brokers, depository participants, and mutual funds and asset management companies. The CSCRF brings SEBI's cybersecurity expectations into a single
9 min read
VAPT
Firewall Configuration Best Practices: How to Secure Your Firewall
Firewalls filter traffic between networks based on rules covering addresses, ports, and protocols. A firewall with weak rules, default credentials, an exposed administration interface, or years of unreviewed exceptions c
9 min read
Industry Insights
Cyberattacks on Indian Hospitals: Ransomware Lessons from the AIIMS Delhi Attack
A hospital cannot simply pause when its systems go down. Patient records, scheduling, laboratory and imaging workflows, and billing usually depend on connected systems, so an attack that encrypts or disables them forces
9 min read
Industry Insights
Cyberattacks on Indian Banks: What Went Wrong and What Regulators Require
Banks are high-value targets because they hold money and sensitive customer data and run complex, interconnected payment infrastructure. This guide reviews two well-documented incidents using public reporting and an RBI
9 min read
Security Awareness
Phishing Attacks: Types, Warning Signs & How to Prevent Them
Phishing works because it targets people rather than software. A message that looks like it came from a bank, a colleague, a vendor, or an executive only has to persuade one employee to act. This guide covers what phishi
8 min read
Security Awareness
Email Account Security Beyond Passwords: MFA, Encryption & Hygiene
Email is the most-used business application and a primary route into an organization. This guide explains the layers of email security: protecting the account (MFA and account hygiene), protecting messages (encryption in
8 min read
Domain Security
DMARC, SPF & DKIM Explained: Email Authentication and Deliverability
Email was designed without sender verification, which is why attackers can forge the "From" address of a trusted domain. SPF, DKIM, and DMARC close that gap. This guide explains what each standard does, how they fit toge
10 min read
Threat Intelligence
Business Email Compromise (BEC): How It Works and How to Prevent It
BEC succeeds by exploiting trust and process, not software. A convincing request that arrives at the right moment — a change of bank details, an urgent wire from the "CEO," an invoice from a known supplier — only needs o
8 min read
Governance, Risk & Compliance
What Is MDR? Managed Detection and Response vs Traditional SIEM
Most organizations don't lack security tooling — they lack the staffing to watch it around the clock and act on what it finds. MDR addresses that gap by pairing detection technology with a managed analyst team responsibl
8 min read
Compliance
What Is DPDP? India's Digital Personal Data Protection Framework Explained
Organizations that process the personal data of individuals in India are increasingly expected to show, not just assert, that they handle that data responsibly. This guide covers what DPDP is, why it matters, who it appl
8 min read
Domain Security
What Is Domain Security? DNS, SSL, DMARC Explained
An organization's domain is one of the few pieces of infrastructure that's simultaneously public, trusted by customers and employees, and often left unmonitored between the moment it's registered and the moment something
9 min read
VAPT
VAPT vs Penetration Testing: What's the Difference?
"Can you run a penetration test?" and "can you run a vulnerability assessment?" are two different requests, even though the answers often come from the same engagement. This guide covers what each activity actually is, h
8 min read
Compliance
Why Consent Management Matters Under DPDP: A Practical Guide for DPOs and Organizations
Consent management is an operational discipline that organizations need whether or not a specific regulatory deadline is imminent — but under DPDP, it also carries specific statutory requirements once those provisions ta
12 min read
Compliance
SOC 2: The Complete Guide to Trust Services Criteria and Compliance
SOC 2 (System and Organization Controls 2) is an attestation framework developed by the AICPA that evaluates how a service organization manages customer data, based on five Trust Services Criteria. Unlike a certification
8 min read
Compliance
PCI DSS: The Complete Guide to Payment Card Data Security Compliance
The Payment Card Industry Data Security Standard (PCI DSS) is a global security standard for any organization that stores, processes, or transmits cardholder data. It's maintained by the PCI Security Standards Council, f
8 min read
Compliance
ISO 27001: The Complete Guide to Information Security Management Certification
ISO/IEC 27001 is the internationally recognized standard for an Information Security Management System (ISMS) — a systematic, risk-based approach to managing an organization's information security. Unlike a checklist of
9 min read
Compliance
GDPR: The Complete Guide to EU Data Protection Compliance
The General Data Protection Regulation (GDPR) is the European Union's comprehensive data protection law, in force since May 2018. It governs how organizations collect, process, and store personal data of individuals in t
8 min read
Governance, Risk & Compliance
Securing the Modern Workplace: On-Site and Remote Cybersecurity Best Practices
Cyber attacks — phishing, ransomware, data breaches, insider threats — aren't hypothetical risks; they're operational realities every connected business faces. Protecting a workplace requires more than deploying tools: i
10 min read
VAPT
Website Vulnerability Management: How to Find and Fix the Flaws Attackers Actually Exploit
Web applications handling customer data or payments are a standing target, and the vulnerability classes that compromise them are well understood and largely preventable. This guide explains four vulnerability classes co
11 min read
Threat Intelligence
Cyber Threat Intelligence: Types, the Six-Stage Lifecycle, and the Role of AI
Threat intelligence lets organizations move from reactive to proactive security — understanding what threats exist, how they operate, and what indicators to watch for, before those threats reach their own environment. Th
12 min read
Governance, Risk & Compliance
Software Supply Chain Security: The Hidden Risk of Open-Source Package Ownership Changes
Open-source software accelerates development by letting teams build on existing code rather than writing everything from scratch — but every dependency is also an inherited trust decision. Package ownership changes, a ro
9 min read
Threat Intelligence
Ransomware: How It Works, Real-World Attacks, and How to Protect Your Organization
Ransomware is malware that encrypts a victim's data and extorts payment for a decryption key, often paired with a threat to leak stolen data if payment isn't made. It causes financial loss (ransom demands, recovery cost,
14 min read
Governance, Risk & Compliance
Insider Threats: The Five Types, How to Detect Them, and How to Build a Layered Defense
Organizations invest heavily in defending against external attackers, but a significant share of security incidents originate from people who already have legitimate access to systems and data. Insider threats aren't alw
12 min read
Security Awareness
Employee Cybersecurity Awareness: Common Threats and What Effective Training Actually Covers
Human behavior remains one of the most consistently exploited paths into an organization, not because employees are careless by nature, but because social engineering is specifically designed to exploit normal human deci
9 min read
Executive Cybersecurity
Cyber Resilience: A Five-Stage Framework for Preparing, Detecting, Responding, and Recovering
No defense stops every attack. Cyber resilience reframes the goal from "prevent all incidents" to "detect, respond to, and recover from incidents fast enough that they don't become business-threatening" — a materially mo
10 min read
Governance, Risk & Compliance
ISO 27001:2022 Transition Guide: What Changed and What It Means Now
ISO/IEC 27001:2022 was released in October 2022, restructuring the standard's control set and introducing new controls addressing cloud security, remote work, and supply chain risk — realities that barely existed when th
8 min read
Industry Insights
Hospital Compliance: A Complete Guide to Healthcare Regulatory Requirements
Hospital compliance spans at least nine distinct regulatory domains: licensing and accreditation, patient data privacy and security, clinical quality and patient safety reporting, anti-fraud and billing integrity, inform
15 min read
Governance, Risk & Compliance
getTRAC: IT General Controls, Audit, and Compliance — How the Platform Works
IT General Controls (ITGCs) are the foundation of a secure IT environment — the controls ensuring the confidentiality, integrity, and availability of systems and data across an organization. getTRAC strengthens four core
6 min read
Compliance
DPDP Act 2023: The Complete Guide to India's Digital Personal Data Protection Law
India's Digital Personal Data Protection Act, 2023 (DPDP Act) received Presidential assent on August 11, 2023, becoming the country's first comprehensive law governing how organizations collect, process, and store digita
7 min read
Industry Insights
Banking Compliance: A Complete Guide to Regulatory Requirements and Operational Readiness
Banking compliance is not one requirement — it's a stack of independent regulatory regimes that a bank must satisfy concurrently: prudential licensing and oversight, anti-money-laundering (KYC/AML) obligations, capital a
13 min read