NextGarrison Security Team
Penetration testers, SOC analysts and compliance consultants
Our consultants test applications and networks, run 24/7 security monitoring and prepare companies for SOC 2, ISO 27001 and PCI DSS assessments. We write about what we see in real engagements, in plain English.
Articles by NextGarrison Security Team (36)
20 Cybersecurity Tips for Small and Mid-Size Businesses
Cybersecurity tips for small and mid-size businesses: 20 practical steps for passwords, phishing, devices, backups, cloud, staff and incident response.
· 7 min read
Threats & VulnerabilitiesActively Exploited Vulnerabilities: What to Patch Now (November 2026)
Critical vulnerabilities attackers are exploiting now: PHP2Shell, Citrix NetScaler, Ivanti, OpenSSH SSHole, PAN-OS, Cisco, Outlook, Chrome and SonicWall, with fixes.
· 8 min read
AI SecurityAI Coding Agents Under Attack: Plugin4Shell, MCP Flaws and How to Protect Developers
AI coding assistants were hit by a wave of flaws in 2026, from Plugin4Shell to MCP command execution. What happened and how to protect your developers.
· 7 min read
iGaming SecurityCasino and Sportsbook Cyber Attacks in 2026: What Operators Can Learn
Cyber attacks hit casinos and betting platforms throughout 2026, from cash-only shutdowns to World Cup bot floods. What happened and the controls operators need now.
· 6 min read
SOC & Incident ResponseDisaster Recovery Planning: RTO, RPO, Backups and How to Build a DR Plan
A practical guide to disaster recovery planning: RTO and RPO with examples, the 3-2-1 backup rule against ransomware, cloud DR options and how to test a plan.
· 7 min read
ComplianceDoes SOC 2 Require a Penetration Test?
SOC 2 does not strictly require a penetration test, but auditors and customers usually expect one. What to test, when to test and what the report should include.
· 5 min read
iGaming SecurityGLI-19 Standards Explained: A Plain-English Guide for iGaming Platforms
What GLI-19 covers, how it differs from GLI-33 and GLI-11, what labs test on an interactive gaming platform and how to prepare your system for certification.
· 6 min read
Penetration TestingHow Much Does a Penetration Test Cost?
What drives penetration test pricing, typical cost ranges by test type, how to compare quotes and how to avoid paying for a scan dressed up as a pentest.
· 6 min read
Security BasicsHow to Spot a Phishing Email: Red Flags, Examples and What to Do
How to spot a phishing email: a red flag checklist, five realistic phishing scams explained, and exactly what to do if you already clicked the link.
· 6 min read
ComplianceHow to Tell Customers Your SOC 2 Is Underway (and Use It to Win Deals)
How to tell customers your SOC 2 is underway but not yet complete: what you can share, what you must not claim, a sample email and how to use SOC 2 in sales.
· 7 min read
SOC & Incident ResponseIncident Response Plan Template: The NIST Lifecycle, Roles and Playbooks
An incident response plan template built on the NIST lifecycle: team roles, severity levels, playbooks for ransomware and BEC, and notification deadlines.
· 8 min read
ComplianceISO 27001 vs SOC 2: Which One Do You Need?
ISO 27001 vs SOC 2 compared: certification vs attestation, who asks for each, cost and timeline, how much they overlap and which to do first.
· 6 min read
SOC & Incident ResponseManaged SOC vs MDR: What Is the Difference and Which Do You Need?
Managed SOC, MDR and MSSP explained in plain English: what each covers, how they respond to threats and how to choose the right 24/7 monitoring for your company.
· 6 min read
iGaming SecurityMGA System Audit Checklist: How to Prepare Your Gaming Platform
A practical checklist to prepare for a Malta Gaming Authority system audit: scope, documentation, security controls, logging and the evidence auditors ask for.
· 5 min read
Penetration TestingPenetration Testing as a Service (PTaaS) vs an Annual Pentest
What penetration testing as a service (PTaaS) is, how it differs from a one-off annual pentest, how each is priced and how to choose the right model for your team.
· 6 min read
Penetration TestingPenetration Testing Methodology: PTES Stages and Standards Explained
Penetration testing methodology explained: the seven PTES stages, how OWASP WSTG, OSSTMM and NIST SP 800-115 fit, black vs gray box, and what a report needs.
· 7 min read
Threats & VulnerabilitiesPHP2Shell (CVE-2026-109618 and CVE-2026-109619): What It Is and How to Fix It
PHP2Shell is a pair of PHP remote code execution flaws exploited in the wild since October 2026. Who is affected, the fixed PHP versions and how to check for compromise.
· 6 min read
Threats & VulnerabilitiesRansomware News: Record Attacks, New Groups and Big Breaches (Autumn 2026)
Ransomware hit record levels in Q3 and October 2026. The biggest attacks and breaches, the most active groups, how attackers got in and what to do about it.
· 7 min read
Threats & VulnerabilitiesReact2Shell (CVE-2025-55182): The React and Next.js Flaw Explained
React2Shell (CVE-2025-55182) is a CVSS 10.0 React Server Components flaw that hit Next.js apps. Affected and safe versions, follow-up CVEs and how to check your apps.
· 7 min read
Penetration TestingSAST vs DAST: How SAST, DAST, SCA, IAST and Pentesting Fit Together
SAST vs DAST explained: what each finds, how SCA, IAST and manual pentesting compare, and how to combine them in a CI/CD pipeline for application security.
· 7 min read
ComplianceSOC 1 vs SOC 2 (and SOC 3): Which SOC Report Do You Need?
SOC 1 vs SOC 2 explained: what each SOC report covers, how SOC 3 differs, Type I vs Type II, a side-by-side comparison table and who needs which report.
· 7 min read
ComplianceSOC 2 for UK Startups: Do You Need It, and Where to Start?
Why UK startups selling to US customers get asked for SOC 2, how it compares with ISO 27001 and Cyber Essentials, and a practical route to your first report.
· 5 min read
ComplianceSOC 2 Is Adding AI Criteria: What the AICPA's 2026 Proposal Means for SaaS Companies
The AICPA proposed new AI points of focus for SOC 2 in October 2026: AI governance, model monitoring, prompt manipulation and data poisoning. What changes and when.
· 5 min read
Threats & VulnerabilitiesSSHole (CVE-2026-123158): The OpenSSH Bypass Explained and How to Fix It
SSHole (CVE-2026-123158) lets attackers bypass OpenSSH password authentication on musl-based Linux such as Alpine. Who is affected, how it is exploited and how to fix it.
· 5 min read
iGaming SecurityUKGC Security Audit: How to Prepare
What the UK Gambling Commission annual security audit covers, how it links to ISO 27001 and the RTS, and a practical checklist to prepare your casino or sportsbook.
· 6 min read
Penetration TestingVulnerability Assessment vs Penetration Testing: What Is the Difference?
The difference between a vulnerability assessment and a penetration test, what each finds, what each costs and when you need one, the other or both.
· 5 min read
Penetration TestingVulnerability Management: A Practical Guide to Building a Program That Works
A practical vulnerability management guide: asset inventory, scan cadence, CVSS, EPSS and CISA KEV prioritization, remediation SLAs, metrics and pentesting.
· 8 min read
Security BasicsWhat Is a Man-in-the-Middle Attack? How It Works and How to Stop It
What is a man-in-the-middle attack? How MITM works, from evil twin Wi-Fi and ARP spoofing to phishing that steals MFA sessions, plus signs and prevention.
· 6 min read
Threats & VulnerabilitiesWhat Is a Zero-Day Vulnerability? Zero-Day Attacks Explained
What is a zero-day vulnerability? How zero-day exploits and attacks work, zero-day vs n-day, why VPNs and firewalls get hit, and how to reduce your risk.
· 5 min read
AI SecurityWhat Is AI Red Teaming? A Guide for Teams Shipping LLM Features
AI red teaming explained: how attackers misuse chatbots, AI agents and RAG systems, what the OWASP Top 10 for LLM Applications covers and how a test works.
· 7 min read
Threats & VulnerabilitiesWhat Is Dark Web Monitoring? And Is It Worth It for a Business?
What dark web monitoring is, what it finds (leaked passwords, customer data, network access for sale) and when it is worth paying for as a business.
· 6 min read
SOC & Incident ResponseWhat Is EDR? Endpoint Detection and Response vs Antivirus, XDR and MDR
What endpoint detection and response (EDR) is, how it differs from antivirus, EDR vs XDR vs MDR, why it needs 24/7 monitoring and how to choose an EDR tool.
· 6 min read
ComplianceWhat Is PCI Compliance? The PCI Data Security Standard Explained
What PCI compliance means, who must comply, the 12 PCI DSS requirements, merchant levels, SAQ vs ROC, how to shrink your scope and the most common v4.0.1 gaps.
· 8 min read
AI SecurityWhat Is Prompt Injection? Direct and Indirect Attacks Explained with Examples
What is prompt injection? Direct and indirect prompt injection explained with realistic examples, why it is hard to prevent, layered defenses and how to test.
· 8 min read
ComplianceWhat Is SOC 2 Compliance? A Plain-English Guide
What SOC 2 compliance means, who needs it, Type I vs Type II, how long it takes and what a SOC 2 audit costs. A plain-English guide for SaaS and fintech teams.
· 8 min read
Security BasicsWhat Is Social Engineering? 8 Attack Types and How to Defend Against Them
What is social engineering in security? The 8 most common social engineering attacks, from phishing to help desk calls, and the defenses that stop each one.
· 6 min read