Learn
Security concepts, explained straight.
Plain-English explanations of the attack techniques and defense approaches behind the Cyberdis portfolio - written to answer the question, not to pad a page.
What is remote browser isolation?
Remote browser isolation (RBI) is a security technology that executes all web browsing in a disposable container in the cloud instead of on the user’s device.
Read the explainer Browser SecurityWhat are highly evasive adaptive threats (HEAT)?
Highly evasive adaptive threats (HEAT) are web-borne attacks specifically engineered to bypass detection-based security - secure web gateways, email filters, sandboxes and signature engines.
Read the explainer Browser SecurityWhat is Content Disarm and Reconstruction (CDR)?
Content Disarm and Reconstruction (CDR) is a file-security technology that deconstructs a downloaded or emailed file, removes every element that could carry active code - macros, embedded objects, scripts - and rebuilds a clean, fully functional copy.
Read the explainer Payment SecurityWhat is business email compromise (BEC)?
Business email compromise (BEC) is a fraud technique in which attackers use email that appears legitimate - a spoofed executive, a look-alike domain, or most dangerously a genuinely compromised business mailbox - to trick employees into transferring money or changing payment details.
Read the explainer Payment SecurityWhat is vendor impersonation fraud?
Vendor impersonation fraud (also called invoice fraud or supplier fraud) is a scheme in which an attacker poses as a legitimate supplier to redirect payments the business genuinely owes.
Read the explainer Endpoint SecurityWhat is data exfiltration?
Data exfiltration is the unauthorized transfer of data out of an organization - the step where a breach becomes a loss.
Read the explainer Endpoint SecurityHow does endpoint security work in air-gapped environments?
Air-gapped endpoint security is endpoint protection designed to operate without cloud connectivity - for isolated networks in defense, critical infrastructure, industrial and high-sovereignty environments.
Read the explainer Identity SecurityWhat are identity operations?
Identity operations is the ongoing work of making an identity and access management (IAM) program actually run: onboarding applications, rolling out policy, remediating drift and keeping coverage complete as the environment changes.
Read the explainer Identity SecurityWhy do IAM implementations stall?
IAM implementations stall because the effort model is wrong for the problem: every application is a manual integration project, the long tail of legacy and custom apps resists connectors, and the environment changes faster than consultant-driven projects can close.
Read the explainer Browser SecurityWhat is a value-added cybersecurity distributor?
A value-added distributor (VAD) in cybersecurity is a company that brings security vendors to market through resellers while adding the technical services the transaction needs: partner enablement, pre-sales engineering, proof-of-concept execution, deployment and post-sale support.
Read the explainer Payment SecurityWhat is payment fraud?
Payment fraud is the use of deception to redirect, extract or manipulate business payments - through compromised email threads, falsified invoices, changed bank details, taken-over accounts or manipulated vendor records.
Read the explainer Payment SecurityHow do you detect a fraudulent invoice?
A fraudulent invoice is detected by its context, not its appearance: modern invoice fraud reuses genuine invoices with only the payment details altered.
Read the explainer Payment SecurityCan you recover money after payment fraud?
Money lost to payment fraud is sometimes recoverable, but the odds decay by the hour.
Read the explainer Endpoint SecurityWhat is endpoint security?
Endpoint security is the practice of protecting the devices where work happens - laptops, desktops, servers and mobile devices - against compromise, data theft and misuse.
Read the explainer Endpoint SecurityWhat is EDR (endpoint detection and response)?
Endpoint detection and response (EDR) is a security technology that continuously records activity on endpoints, detects suspicious behavior, and gives security teams the tools to investigate and respond - isolating hosts, killing processes and rolling back changes.
Read the explainer Browser SecurityWhat is an enterprise browser?
An enterprise browser is a web browser built or managed for corporate control: policy enforcement, data-loss controls, session governance and visibility live inside the browsing experience itself.
Read the explainer Browser SecurityWhat is HTML smuggling?
HTML smuggling is an attack technique that assembles a malicious payload inside the victim’s browser using JavaScript, instead of downloading it from the network.
Read the explainer Identity SecurityWhat is identity governance and administration (IGA)?
Identity governance and administration (IGA) is the class of IAM platform that manages the lifecycle of identities and their access: provisioning and deprovisioning accounts, access requests and approvals, certification campaigns, and audit reporting.
Read the explainer Identity SecurityWhat are non-human identities (NHI)?
Non-human identities (NHI) are the accounts and credentials that belong to software rather than people: service accounts, API keys, machine certificates, workload identities and, increasingly, AI agents acting with delegated permissions.
Read the explainer Identity SecurityHow much does IAM implementation cost?
IAM implementation typically costs a multiple of the software license.
Read the explainer Endpoint SecurityWhat is credential dumping?
Credential dumping is the theft of stored authentication material from an operating system: passwords, hashes and tickets extracted from memory structures such as LSASS, from the SAM database, or from DPAPI stores.
Read the explainer Human Risk ManagementWhat is human risk management?
Human risk management (HRM) is the practice of measuring and reducing the security risk created by employee behavior - clicks, credential habits, data handling - rather than just delivering training about it.
Read the explainer Human Risk ManagementWhat is security awareness training?
Security awareness training (SAT) is structured education that teaches employees to recognize and respond to cyber threats - phishing, social engineering, unsafe data handling and credential misuse.
Read the explainer Human Risk ManagementWhy does security awareness training fail?
Security awareness training fails when it changes what employees know without changing what they do.
Read the explainer Insider Risk ManagementWhat is insider risk management?
Insider risk management (IRM) is the discipline of detecting and mitigating security risk from identities that already have legitimate access - employees, contractors, and increasingly AI assistants acting on their behalf.
Read the explainer Insider Risk ManagementWhat is shadow AI?
Shadow AI is the use of AI tools inside an organization without sanction or oversight - employees pasting company data into personal chatbots, connecting unapproved AI plugins to corporate accounts, or delegating tasks to AI agents that then act with the employee’s access.
Read the explainer Insider Risk ManagementWhat is behavioral DLP?
Behavioral DLP is data loss prevention that decides based on behavior rather than content patterns alone: who is handling the data, how that compares to their normal activity, where it is heading, and what the surrounding actions suggest about intent.
Read the explainer Endpoint DeceptionWhat is endpoint deception?
Endpoint deception is a preemptive security technique that makes every endpoint appear hostile and unworthy of attack to malware.
Read the explainer Endpoint DeceptionWhat is deception technology in cybersecurity?
Deception technology is a class of cyber defense that feeds attackers false information about the environment they are attacking.
Read the explainer Endpoint DeceptionWhat is sandbox evasion?
Sandbox evasion is the set of techniques malware uses to detect whether it is running inside an analysis environment - a sandbox, virtual machine or researcher’s lab - and to stay dormant or terminate if so.
Read the explainer AI & Software GovernanceWhat is an endpoint security control plane?
An endpoint security control plane is a governance layer that inventories everything running on corporate endpoints - applications, browser extensions, code libraries and AI tools - assesses each item’s risk in the context of the user and device it sits on, and enforces policy with granular remediation.
Read the explainer AI & Software GovernanceHow do malicious browser extensions attack organizations?
Malicious browser extensions are add-ons that abuse the browser’s permission model to steal data: reading every page a user visits, harvesting session cookies and credentials, or injecting content into trusted sites.
Read the explainer AI & Software GovernanceWhat is an npm supply-chain attack?
An npm supply-chain attack compromises organizations through the open-source packages their developers install from the npm registry.
Read the explainerFrom theory to PoC
Seen the concept? See it running.
Every explainer here maps to a vendor Cyberdis distributes - and to a proof of concept our engineers can run in your environment.