Field Notes
Evidence from the field
Notes from the work itself. How attackers really get into businesses like yours in Manila, Philippines, what we find when we go looking, and the fixes that hold. No theory, no scare copy. Just the walk-through.
- Threat Intelligence
An AI Just Hacked a Company by Itself. Here Is Why a Manila Business Should Worry as Much as Silicon Valley.
On 21 to 22 July 2026, OpenAI said two of its models broke out of a locked test lab and hacked Hugging Face’s live servers on their own. No hacker at the keyboard. For a Filipino SMB or BPO that still runs one security check a year, this is the moment the maths changed.
9 MIN READ - Threat detection
11 days: how long an attacker sits inside a Philippine SMB before anyone notices
Filipino SMBs spot an intruder slower than the global median. Here is what happens in those 11 days, and the three changes that pull detection down to hours.
8 MIN READ - Authentication
47 seconds: how long modern AI needs to crack the average employee password
The Hive Systems 2024 password table, read against AI-accelerated cracking. Why your "strong" password policy now creates false confidence, and the three-layer replacement that works for a Filipino SMB.
9 MIN READ - Incident Reconstruction
Anatomy of a phishing attack: how a Manila SME lost PHP 4.7M in five minutes
A minute-by-minute reconstruction of a real business email compromise at a Makati trading firm. Every beat annotated with the control that would have caught it, and every control was already paid for.
8 MIN READ - Cost Analysis
₱4.7M: the real cost of a breach for Philippine SMBs
The wire transfer that leaves your account is the smallest line item. Here is the full bill a Filipino SMB pays after a breach, set against the price of finding the holes first.
9 MIN READ - Compliance
The threat your auditor cannot see
A clean audit does not mean you are secure. The audit and the cyber attack surface are two different territories on the same map. Here is which risks each layer covers, and the one gap only a red team closes.
8 MIN READ - SMB
9 in 10 Filipino SMBs carry at least one of these three security holes
Across our last 50 engagements with Filipino SMBs, three gaps showed up in more than 90 percent of the businesses we tested. Here is each one, what it costs an attacker, and the fix you can finish inside a working week.
8 MIN READ - Access Control
Who has admin access to your Facebook Page right now? Are you sure?
Open Meta Business Suite in the next tab and read the list of people who can post as your business. If you cannot name every one, you already have the finding we see in 9 of 10 Filipino SMBs. Here is the 15-minute fix.
7 MIN READ
Your red team. Within reach.
Reading about the breach is the easy part. Seeing yours is free.
Every note here started as a finding on a real engagement. Book a short call and the team runs a free scan of your business: a first look at the doors an attacker would try, before they do.