Secure Ideas

09/03/2026

Seats close September 6. It's not too late to sign up!

10 weeks, all 8 CISSP domains, pay-what-you-can pricing. Enroll once and you can rejoin any future session free. Don't wait on this one.

Enroll now: https://hubs.la/Q04tRmvP0

08/28/2026

Seats are still available for the Professionally Evil CISSP Mentorship Program, and classes begin September 1.

10 weeks of live, instructor-led mentorship covering all 8 CISSP domains. Tuesdays, 2–4pm ET. Pay what you can, no minimum.

You'll get the official study guide, weekly live sessions, session recordings, a private Slack channel, and practice exams.

Enroll now: https://hubs.la/Q04tQppd0

08/25/2026

Kevin Tackett is speaking at OWASP Phoenix

Tuesday, September 1 at 7:30 PM, Kevin will take the OWASP Phoenix Chapter through the tangled ruins of modern application architecture in "Raiders of the Lost Architecture: Security Testing in Modern Applications."

In this talk, Kevin Tackett takes attendees on an expedition through the tangled ruins of modern application architecture. Drawing from real-world pe*******on testing engagements, he will share stories of uncovering forgotten API endpoints still connected to production data, third-party integrations that outlived their original purpose but retained their access, and AI components bolted onto legacy systems with little consideration for the attack surface they introduced. Like any good archaeologist, a security tester must piece together fragments of understanding while avoiding the traps left behind by those who built before them.

📍 HeatSync Labs, 108 W Main St, Mesa, AZ
🕢 7:30 PM
Free and open to all

Details and registration: https://hubs.la/Q04vgTM20

08/25/2026

Most CISSP courses are taught by people who teach for a living. Ours are taught by people who break things for a living.

Our instructors have decades of hands-on, real-world security experience. You're learning from practitioners, not a textbook.

Enroll now: https://hubs.la/Q04tCV5G0

08/21/2026

Scheduling an external pentest? The prep work matters just as much as the testing itself.

Two things to nail down before your kickoff call:

Know your scope before the attacker does. Build an asset inventory of your public-facing IPs and think through your goals for the assessment. Not sure of your full scope? That's normal, but don't wait until the day before testing to figure it out. A finalized scope is needed at least a week out.

Designate a point of contact. Connection issues, critical findings that need immediate attention, someone needs to be reachable when it counts. No point of contact often means delays or shifted testing dates.

Our latest blog breaks down the pre-engagement essentials, the four phases of an external pentest (recon, discovery, validation and exploitation, reporting), and how to prioritize remediation once your report lands.

Read it here:

Prepare for an external pe*******on test by understanding scope, communication, and remediation to strengthen your organization's security posture.

08/20/2026

Still telling yourself you'll start studying for the CISSP "next month"?

The Professionally Evil CISSP Mentorship Program is 10 weeks of live, instructor-led sessions covering all 8 CISSP domains. Starts September 1. No prior CISSP coursework required.

Enroll now: https://hubs.la/Q04tCYwM0

08/14/2026

Robotic Process Automation and Low-Code/No-Code platforms are reshaping how businesses operate, letting teams automate workflows faster and with less overhead. But what happens when the automation itself becomes the risk?

Jordan Bonagura, Senior Security Consultant at Secure Ideas, is speaking at the ISC2 Central Florida Chapter meeting hosted by Full Sail University.

When the Robots Start Acting Crazy: A Security Approach

Jordan will explore the intersection of automation and security, looking at real-world scenarios where RPA and LCNC tools go rogue, and the impact on data, infrastructure, and compliance when they do. The session covers how to recognize, mitigate, and recover from these risks before they turn into breaches.

📍 Full Sail University, Winter Park, FL
🗓️ Monday, August 24th, 2026
🕕 6:00 PM - 9:00 PM
Hosted by ISC2 Central Florida

Register here: https://hubs.la/Q04t2R_J0

08/11/2026

Proud to see our CEO Kevin Tackett quoted in HuffPost this week on the Zbtlink router backdoor story.

Researchers at VulnCheck found that over 20 router models sold under the Zbtlink and Wiflyer brand names shipped with a hidden implant that phones home to servers in China every 35 seconds, giving an attacker full root access to the device. An estimated 100,000+ routers worldwide may be affected.

Kevin's take: this isn't a bug you patch, it's a trust problem. If your router's label says Zbtlink, ZBT, ZBTWiFi, or Wiflyer, the recommendation is simple: replace it.

Check the full article for how to identify affected models:

Your most sensitive information could be at risk. Here’s what you need to know.

08/03/2026

Over the last few months we followed one droid from concept to convention floor: teaching it to see, building the body, and finally putting it in front of a real crowd at Orlando Maker Faire.

Doug just dropped Part 4: three days of kids waving, adults asking questions, and a droid that had to prove itself outside a controlled test. What worked, what broke, and where the build goes next.

Read the finale:

Three days at Orlando Maker Faire with an AI-powered Star Wars Pit Droid. What worked, what failed, and how the project evolves with Claude and Cowork.