Are there AI Agents in your M365 tenant? Defender XDR can monitor them.

We cover the setup, the Sentinel tables that matter, out-of-the-box alerts from his own lab and containment options: blog.compass-security.com/2026/11/securi…

Come by our booth at #BlackAlps26! Customize your e-ink NFC badge with your name and an AI portrait, generated locally on the spot. And the badge may hide more than meets the eye… 👀
📅Nov 5/6 📍Yverdon-les-Bains (CH)

From an unauthenticated music add-on to root on the host. At #Pwn2Own Ireland 2025, our team chained their way through the Home Assistant Green and walked away with $20k. Emanuele shows the full chain, and how it nearly failed on stage. blog.compass-security.com/2026/10/pwn2ow…
#IoTSecurity

Compass Security supports Graubündner Kantonalbank with a structured bug bounty program that enables responsible reporting of potential vulnerabilities within a defined framework.
bugbounty.compass-security.com/service-detail…
#bugbounty #ethicalhacking #cybersecurity

What’s for dessert? Root. 😈
After lunch at #BruCON0x12: Emanuele and @yves_bieri present Pwn the Hub, Own the Home

One vulnerable add-on → RCE → container escape → full Home Assistant compromise.

From 11 September 2026, manufacturers selling digital products in the EU have 24 hours to report actively exploited vulnerabilities. ⏱️ Andreas Brombach explains what is reportable, and how to actually make those deadlines: blog.compass-security.com/2026/09/cra-re…

#CRA #ProductSecurity

Pentesting passkeys? Security analyst @emanuelduss shows two JS snippets for tampering with the WebAuthn APIs. Handy for checking if you can login using a security key without knowing the PIN.

Check out the technical details and how he got there: blog.compass-security.com/2026/08/a-note…

Pipeleek 1.0 is out 💧 Secret scanning across 7 CI/CD platforms, plus runner and Renovate bot exploitation.

Want to see one leaked job log turn into repo takeover? Try our deliberately vulnerable GitLab Attack Lab. Happy leeking!

blog.compass-security.com/2026/08/pipele…

#DevSecOps #CICD

Your team evaluated that automation platform as a productivity tool. Attackers see a jump host with SSH access, stored credentials, and a path around your network segmentation.

Read our latest blog post before deploying any automation platform: blog.compass-security.com/2026/07/the-hi…

How do you translate the Cyber Resilience Act into technical testing? Part II of our #CRA series follows a cheap IP camera, from STRIDE threat modelling and firmware analysis to compliance with IEC 62443-4-2.
blog.compass-security.com/2026/06/cyber-…
#CyberSecurity #CyberResilienceAct #IEC62443

How do you prepare a product for the Cyber Resilience Act? Our latest article covers #CRA scope, product classification, threat modelling, technical security testing, and why we use IEC 62443 as an assessment framework. Part I of a two part series: blog.compass-security.com/2026/06/cyber-…

Attending @a41con in Dübendorf (CH)? 🎯 Swing by our booth and check out RAPTR: our open-source collab platform for Purple Team ops. Plan, attack, detect, report. All in one place.

See you there on Thursday/Friday!

#Area41 #PurpleTeam

At @a41con next week?👋

Come to our booth to see EntraFalcon in action: our open-source tool for assessing Microsoft Entra ID security posture. Privileged objects, risky assignments, conditional access misconfigs: find what's hiding in your tenant.

AI agents in your Entra ID tenant? They come with new identities, permissions, fresh attack paths.

Chrigi @ZH938472 breaks down Entra Agent ID security, their capabilities, control paths, abuse scenarios, and how to review your exposure with EntraFalcon.

blog.compass-security.com/2026/06/entra-…

The monkey is still curious 🐒 Teleboy has topped up its bug bounty program with another CHF 10'000 in rewards. Explore a platform serving 400'000+ users across TV, internet, and telephony. Ready for another hunt? #bugbounty #ethicalhacking #cybersecurity

bugbounty.compass-security.com/bug-bounties/t…

SSH everywhere, misconfigurations somewhere. Our new SSH Labs let you get your hands dirty: slides, video, and a Docker-based lab. Created by our Security Analyst @emanuelduss, learn how SSH breaks and how to fix it: blog.compass-security.com/2026/05/ssh-la…

#SSH #InfoSec #Security

AREA41 testing in full swing - excited for the conferenec 😎

Thank you, @a41con ! Excited to be on board as a Platinum Sponsor. Looking forward to connecting with the community on-site!

Compass vulnerability research identified code execution paths affecting AI coding assistants including @claudeai , @cursor_ai and @OpenAI #Codex. The findings will be demonstrated live at @thezdi Initiative #Pwn2Own Berlin 2026, May 14 to 16. #AIsecurity #LLM

🦖 Meet RAPTR: our new open source platform for red and purple team collaboration. Plan engagements, document attacks and detections, evaluate results, and generate reports, all API-driven. Beta is live, feedback welcome! #PurpleTeam

blog.compass-security.com/2026/05/introd…