A viral warning has been making the rounds again: the peace sign, finger hearts, and other hand gestures we love to flash in photos could be exposing something far more sensitive than we realize, our fingerprints.

Filipinos rank among the highest in the world for time spent on social media, averaging close to five hours a day according to the Digital 2026 Philippines report from We Are Social and Meltwater. For a country that spends that much time posting, this is not just an internet curiosity. It touches how we log into our banking apps, how we register for government IDs, and how we prove who we are online. For businesses building products around biometric authentication, it is a reminder that convenience and security do not always move in the same direction.

What the Warning Actually Says

According to recent reports, security experts are cautioning that high-resolution photos of hand gestures, especially the "V" or peace sign, can reveal enough fingerprint detail for AI-powered tools to reconstruct a usable print. A demonstration by a Chinese security specialist showed that photos taken within 1.5 meters of a subject could expose fingerprint ridges clearly enough to be extracted, while shots taken from 1.5 to 3 meters away could still reveal roughly half the detail.

The concern picked up renewed attention in South Korea, where hand gestures like finger hearts and the "flower pose" are a staple of everyday photos.

How Real Is the Risk

Short answer: no, not for most people. Here is the context behind that answer. The underlying research behind this warning traces back to a 2017 study by Japan's National Institute of Informatics, which has resurfaced with an AI framing nearly a decade later. The original researchers were not just raising an alarm, they were developing a countermeasure, a film that could obscure fingerprints in photos without affecting their use in verification.

Fact-checkers have also pointed out that extracting a usable fingerprint from a social media photo is harder in practice than headlines suggest. Compression when images are uploaded, inconsistent lighting, camera focus, and motion blur all reduce the clarity of the ridges needed for reconstruction. Attackers would typically need multiple clear, high-resolution photos of the same hand to build a convincing print.

So the honest answer sits between "this is fake" and "this is inevitable." The threat is technically plausible, with research demonstrations and reported incidents suggesting it is possible under the right conditions. It is not, however, an easy or guaranteed attack, and the average person posting a normal photo is at low risk. The people with more to think about are public figures, professionals photographed frequently at close range, and anyone using fingerprint authentication for something high value.

What makes this different from many online security myths is that AI-powered fingerprint reconstruction has already been demonstrated in research settings. The challenge is not whether it can happen. It is whether attackers can obtain images with enough quality to make it practical.

The Local and Global Stakes

This conversation matters everywhere, but the Philippines has particular reasons to pay attention.

Many Filipinos already unlock their phones, authorize banking apps, and verify their identity using fingerprints without thinking twice about it. Biometrics have quietly become part of everyday life, which makes this discussion less about selfies and more about protecting a credential that cannot simply be replaced.

That shift is already visible at the institutional level: the Philippine Identification System (PhilSys) already integrates fingerprint and iris data, PhilHealth is expanding biometric verification for benefits claims, and mobile wallets like GCash and Maya increasingly offer fingerprint login as a convenience feature. The Data Privacy Act of 2012 already classifies biometric data as sensitive personal information, and data privacy concerns around how PhilSys handles that data are already prompting lawmakers to propose amendments, which raises the compliance stakes the moment it is exposed or compromised, not just the inconvenience.

Zoom out and the pattern repeats. Biometric authentication adoption is accelerating worldwide, across banking, border control, workplace access, and smart home devices, all built on the same assumption: that a fingerprint, a face, or an iris scan is something only the legitimate owner can present. The 2025 Hangzhou, China incident, where individuals reportedly attempted to unlock a smart door lock using a homeowner's hand photo posted online, is a preview of what happens when that assumption breaks down. It required no sophisticated hacking tools, only a publicly available photo and patience. For organizations outside the Philippines operating under GDPR or similar frameworks, biometric data carries the same "cannot be reset" problem regardless of jurisdiction.

This is not a reason to panic. It is a reason to be intentional. When a fingerprint is tied to national ID systems, healthcare claims, and financial accounts all at once, the stakes of that credential being compromised are higher than a single hacked social media account.

Why Fingerprints Are Different From Passwords

A password can be reset. A fingerprint cannot.

This is the detail that deserves the most attention from both consumers and the organizations building on biometric authentication.

If a password is compromised, the fix is straightforward: change it, add multi-factor authentication, move on. If a fingerprint is compromised, there is no reset button. That print is tied to a person for life, and it may already be linked to multiple systems, a phone, a national ID, a banking app, a workplace access panel. This is precisely why security practitioners generally recommend that biometrics be used as one factor among several, not as a sole gatekeeper for high value accounts or systems.

Practical Steps Worth Taking

For individuals:

• Think twice before posting high-resolution, close-up photos where fingers are clearly exposed toward the camera, especially in professional headshots or promotional material.
• Review privacy settings on social platforms and limit who can view and download full-resolution images.
• Avoid relying on fingerprint unlock alone for devices or accounts that protect sensitive data, and pair it with a PIN or passphrase where possible.

For organizations building or deploying biometric systems:

• Do not treat biometric authentication as inherently secure by default. Like any authentication mechanism, it needs to be tested against real attack scenarios, not just assumed to work.
• Layer biometrics with additional factors for anything tied to financial transactions, government identity verification, or sensitive personal data.
• Build a process for what happens if a biometric credential is suspected to be compromised, since it cannot simply be reissued the way a password can.

What This Means for Your Security Posture

The peace sign scare is a useful reminder, but the real lesson is broader: authentication systems, biometric or otherwise, are only as strong as the testing behind them. Whether your platform uses fingerprint login, facial recognition, or a traditional password and OTP combination, the question that matters is whether it has been put through real-world attack scenarios before someone else tries them first.

It helps to separate the two risks here. The consumer-side risk is about photo hygiene: what you post, and how much of your fingerprint is visible in it. The organization-side risk is different: whether the biometric authentication system you built or deployed can actually withstand someone trying to break it. No pentest can stop someone from screenshotting a selfie. What it can do is test whether your fingerprint verification flow, session handling, and APIs hold up when someone tries to exploit them anyway.

Modern biometric systems rely on far more than matching fingerprint patterns alone. Many also use anti-spoofing techniques, liveness detection, secure enclave storage, and risk-based authentication to prevent attackers, including those using AI-generated biometric replicas, from simply presenting a copied fingerprint. Those protections, however, should be validated through regular security assessments rather than assumed to work as intended.

This is where security testing becomes critical. Even if biometric credentials are exposed, the systems that rely on them should still be resilient against real-world attacks. A structured penetration test can surface authentication weaknesses, whether in a fingerprint verification flow, a session management gap, or an API endpoint, before they turn into headlines.

If your organization handles biometric data, identity verification, or any authentication system that your users trust with sensitive access, it is worth having it independently assessed.

Talk to our team at sales@secuna.io or explore how Secuna Pentest can help at secuna.io.

Sources: Fingerprint theft: Think twice before posing with hand signs, Inquirer.net · Not just a pose: Hand signs in photos can compromise biometric security, Cebu Daily News · 'Think twice before posing with hand signs': Experts warn of fingerprint theft, The Korea Herald · Can Hackers Use Peace Sign Selfies to Steal Fingerprints and Identities?, Snopes · That peace sign you do in your selfies could let AI steal your fingerprints for scammers, Tom's Guide · Digital 2026: The Philippines, DataReportal · Data privacy issues in Philippines trigger move to amend national ID law, Biometric Update · Experts Warn About Fingerprint Theft from Popular 'V' Hand Gesture in Selfies, Oddity Central.

If you have noticed your banking app asking for a face scan or fingerprint instead of a text message code, that is not a coincidence. Starting June 25, 2026, Philippine banks and e-wallet operators are no longer allowed to use SMS- or email-based one-time passwords (OTPs) to verify high-risk financial transactions. The Bangko Sentral ng Pilipinas (BSP) made it official, and it affects everyone who moves money digitally in the Philippines.

For everyday users of GCash, Maya, or online banking apps, the change will feel subtle at first: a biometric prompt instead of a text message, a fingerprint scan instead of a six-digit code. For the organizations behind those apps, and for any business relying on similar verification methods to protect its own systems, it raises a harder question: if the BSP had to mandate a ban to protect Philippine consumers from a method most people trusted for years, what other security assumptions in your environment have already expired?

The shift might feel minor on the surface. But it is built on a serious security reality: the six-digit code sent to your phone was never as safe as it seemed. And understanding why matters, because the same vulnerabilities that put your bank account at risk also put your organization's systems at risk.

What the BSP Actually Requires

BSP Circular No. 1213, issued in May 2025, implements Section 6 of the Anti-Financial Account Scamming Act (AFASA), or Republic Act No. 12010. It requires BSP-supervised financial institutions to replace SMS and email OTPs with stronger authentication methods for high-risk transactions, with a deadline of June 25, 2026.

The institutions covered include universal and commercial banks, all digital banks, and select cooperative, thrift, and rural banks: specifically those averaging more than P75 million in online transactions per month. That covers most of the apps and platforms Filipinos use daily, from major banks to digital wallets.

This was not a precautionary upgrade. It was a direct response to a fraud crisis. The Philippines recorded a 95% increase in financial fraud complaints from 2022 to 2023, and by 2024, 13.4% of all digital transactions in the country were flagged as potentially fraudulent, the second-highest rate globally. Phishing alone generated PHP 623 million in losses in 2022, while account takeover fraud added PHP 409 million. GCash users lost PHP 76.49 million in recent years, BPI users PHP 28.47 million, and Maya users PHP 13.99 million. Between 2024 and 2025, phishing websites targeting Filipino users surged 423%, from 731 to 3,824 sites.

AFASA criminalized social engineering, phishing, smishing, and OTP harvesting. The pattern it identified was consistent: attackers were exploiting SMS-based verification as the weakest point of entry. The phishing pages were convincing. The SIM swaps were easy to execute. The OTPs being texted to users were being intercepted, harvested, and submitted before victims realized anything was wrong. BSP Circular 1213 was the regulatory response to that pattern.

Under the directive, high-risk transactions include large fund transfers, payments to new recipients, and significant account changes. SMS OTPs remain permitted for lower-risk activity. Banks are also required to implement real-time fraud detection capable of flagging rapid transactions, new payees, and logins from unrecognized devices before a fraudulent transfer completes.

BSP Deputy Governor Lyn Javier put it plainly: "We are pleased that banks and e-wallet operators are stepping up on both fronts." Many institutions had already begun transitioning ahead of the deadline, a sign that the industry recognized what regulators formalized.

Why SMS OTPs Were Never as Secure as You Thought

When SMS OTPs were first introduced, they represented a genuine improvement over password-only authentication. A short-lived code delivered to a device only you carry felt like a solid second factor. The problem is that attackers, telecom infrastructure vulnerabilities, and phishing toolkits have evolved much faster than the technology itself.

According to the Verizon 2026 Data Breach Investigations Report, the human element is involved in 62% of breaches, with phishing and credential abuse accounting for the majority of initial access vectors. The shift away from SMS OTPs reflects a broader industry trend: authentication methods are evolving because attackers have become increasingly effective at exploiting channels that were once considered trustworthy.

SIM Swapping

The most well-known attack against SMS-based authentication does not require any technical sophistication. An attacker contacts your mobile carrier, impersonates you, and convinces an employee to transfer your phone number to a new SIM card under their control. From that point, every OTP meant for you goes to them instead. SIM swap fraud has been used to drain bank accounts, hijack cryptocurrency wallets, and take over high-value social media profiles. In early 2025, Philippine authorities arrested 38 individuals and seized over 7,900 SIMs already linked to bank and e-wallet accounts. The attack is disturbingly simple because it exploits human processes, not software vulnerabilities.

SS7 Protocol Exploits

Signaling System No. 7 (SS7) is the protocol that underlies global telecom routing. It was built in 1975, long before anyone imagined that criminal organizations or nation-state actors would want to exploit it. Yet that is exactly what has happened. Attackers with access to the telecom backbone can silently redirect SMS messages to a device they control without any involvement from the target. The victim's phone shows no sign of intrusion. The OTP simply never arrives, or arrives somewhere else.

Real-Time Phishing and Adversary-in-the-Middle Attacks

Modern phishing attacks do not wait for you to hand over your password. They relay everything in real time. An attacker sets up a convincing proxy of a bank login page. When you enter your credentials, the attacker forwards them to the real bank site and triggers an OTP request. You receive the code, enter it on the fake page, and the attacker submits it on the real one, completing the transaction before the code expires. In some cases, scammers call victims directly, posing as bank representatives, and talk them into reading the OTP aloud. The entire attack can happen in under a minute. Phishing sites targeting Filipino users jumped 423% in 2025 alone, from 731 to 3,824 active sites.

Malware and SMS Interception

Mobile malware capable of reading SMS messages is widely available and, on some platforms, surprisingly easy to deploy. An app granted SMS read permissions can silently forward every OTP it sees to an attacker's server. The user never knows. The transaction appears legitimate. The funds are gone.

The underlying problem is the same across all of these attacks: SMS OTPs treat the mobile network as a trusted, secure channel. It is not. It was never designed to be.

Why the New Methods Are Actually More Secure

The authentication methods replacing SMS OTPs do not just patch over the weaknesses. They eliminate the attack surface entirely. Here is how each one works and why it holds up better.

Biometric Authentication

Your fingerprint, face, or iris cannot be forwarded over a compromised network, handed to a scammer over a fake login page, or intercepted by malware. When verification is tied to something you are rather than a code you receive, the entire class of OTP attacks becomes irrelevant. A fraudster who knows your password and intercepts your OTP still has no way to produce your fingerprint. Modern biometric systems also include liveness detection, making it significantly harder to spoof authentication with a photo or a recording.

Behavioral Authentication

Behavioral biometrics analyze patterns that are nearly impossible to consciously replicate: the pressure of your finger on a screen, the rhythm of your typing, the angle at which you hold your phone, the speed of your swipes. These signals are invisible to the user but highly distinctive. More importantly, behavioral authentication can run continuously throughout a session, not just at login. If something about how a session is being conducted shifts, because a fraudster has taken over a device or session, the system detects it and can step up verification or terminate the session.

Passwordless Authentication (FIDO2 / Passkeys)

Passkeys and FIDO2-compliant solutions use public-key cryptography instead of shared secrets. When you authenticate, your device generates a cryptographic proof specific to that exact site and session. Nothing leaves your device for an attacker to intercept. Phishing fails because the proof is bound to the legitimate domain: a fake site cannot receive a valid response even if it tricks you into trying. There is no code to steal, no password to guess, no channel to exploit.

Adaptive and Risk-Based MFA

Rather than applying the same verification method to every transaction, adaptive authentication evaluates context in real time: What device is this? Is this a new location? Is this a transaction pattern consistent with this user? Is this payee new? Based on the risk score, the system decides whether to proceed, request additional verification, or flag the transaction for review. Low-risk transactions flow smoothly. High-risk transactions get the scrutiny they deserve.

What This Means Beyond Banking

The BSP directive applies to supervised financial institutions. But the security implications extend well beyond the banking sector.

If SMS OTPs are weak enough to be banned by a central bank for high-risk financial transactions, they are equally weak when used to protect any other high-value system: enterprise portals, government platforms, healthcare records, or any application where the cost of unauthorized access is significant. The same attack vectors the BSP is guarding against, SIM swapping, SS7 exploits, phishing, and malware, apply just as readily to corporate email accounts, HR systems, ERP platforms, and customer databases.

For organizations, this is a practical prompt. Audit where SMS OTPs are still in use across your systems, not just in customer-facing flows but in internal tools, admin portals, and account recovery processes. Evaluate whether high-risk actions are protected by phishing-resistant MFA such as FIDO2 or passkeys. And test your authentication implementations to verify that controls hold up under real attack conditions, not just on paper.

Is Your Organization's Authentication Stack Actually Secure?

The BSP directive is a regulatory floor, not a ceiling. Meeting compliance requirements means replacing SMS OTPs in specific contexts. But it does not answer the broader question: are the other authentication and access controls in your organization's environment actually secure?

That requires a different kind of assessment: one that looks at your systems the way an attacker would.

That means testing your authentication against people who think like attackers: verifying that your implementations cannot be bypassed, your session management cannot be hijacked, and your MFA cannot be defeated before a real threat actor gets the chance to try. It also means building structured channels for ongoing discovery, through vulnerability disclosure and bug bounty programs, so gaps get reported and fixed before they surface somewhere worse.

The transition away from SMS OTPs is a signal that the standard for "secure enough" is rising. Organizations that wait for the next regulatory mandate to find out where their weaknesses are will consistently be one step behind.

The Bar Just Moved

SMS OTPs did their job for a time. They were better than passwords alone, and for years, they were the most practical option available. But the threat landscape has matured, fraud tools have become accessible to non-experts, and the cost of a compromised authentication method has grown alongside the volume of digital financial activity in the Philippines.

The BSP's directive is not a bureaucratic formality. It is a clear signal from the central bank of a country with over 100 million people: the old method is no longer acceptable for protecting high-stakes transactions.

The next question for every organization is not whether their bank has updated its authentication. It is whether their own systems are still relying on security mechanisms that belong to a previous era. That is a question worth answering before an attacker does it for you.

Finding the answer requires looking at your systems the way an attacker would: testing whether your authentication can be bypassed, your sessions hijacked, and your controls defeated under real conditions, not just on paper. Through penetration testing, bug bounty programs, and coordinated vulnerability disclosure, Secuna helps organizations do exactly that. Reach out at sales@secuna.io or visit secuna.io.

Sources: No more SMS, email OTPs for high-risk financial transactions starting June 25, GMA News · Many banks and e-wallets have phased out OTPs for authentication, BSP says, BusinessWorld · BSP Circular 1213: Philippine banks must replace SMS OTPs by June 2026, Authsignal · AFASA Booklet with Implementing Rules and Regulations, BSP · AFASA Explained: What the Philippines' New Anti-Scam Law Means, Tookitaki · Philippines Scams 2025: Second-Highest Global Fraud Rate, ScamWatchHQ · Phishing Sites in PH Jump 423% in 2025, Newsbytes PH · Account Takeover Fraud in the Philippines, Tookitaki · 6 Reasons SMS OTP Is Being Banned Worldwide, Security Boulevard · Protecting SMS OTPs From SS7 and Diameter Attacks, Efani · Biometrics, Smart OTP, Passkey/FIDO2: Passwordless Authentication for Stronger Fraud Prevention, Savyint · What Is OTP Authentication? Risks and Alternatives, iProov · 2026 Data Breach Investigations Report, Verizon

In our previous blog, we closed with a point worth sitting with: phishing does not end with one person. Every credential stolen from an individual is a potential door into something larger: a company, its internal systems, its customer data, and its compliance obligations.

That is where this piece picks up.

Picture a member of your finance team receiving an email from the CEO. The name is right, the email signature is formatted correctly, and the request is urgent: a wire transfer needs to go out today for a deal that cannot wait. It is a Friday afternoon. The CEO is traveling. The employee processes the transfer.

The CEO never sent that email.

This is one of the most commonly reported fraud scenarios in the world, and it cost businesses close to $2.8 billion in 2024 alone, according to the FBI's Internet Crime Complaint Center. Globally, business email compromise has cost organizations more than $17 billion over the last decade. And for organizations that suffer a phishing-enabled breach, the consequences rarely stop at stolen funds. Regulatory penalties, incident response costs, reputational damage, and customer attrition all follow.

Philippine organizations are not insulated from this. As more businesses move customer interactions, payments, and support services online, phishing has evolved from a consumer threat into a business risk with measurable financial, legal, and operational consequences.

How Businesses Get Targeted Differently

Consumer phishing is a volume game. Business-targeted phishing is a precision operation. Attackers research their targets, study internal structures, and craft messages designed to fit naturally into existing workflows. The goal is not your account. It is whatever is accessible through you.

Business Email Compromise (BEC)

BEC is the highest-cost cyber threat facing organizations globally. The attacker impersonates an executive, a vendor, or a trusted internal contact to manipulate someone into authorizing a fraudulent transaction. No malware required. No sophisticated exploit. Just a convincing email and an organizational process that does not require independent verification before acting. The FBI recorded 21,442 BEC complaints in 2024, but the actual figure is believed to be significantly higher. Many incidents go unreported because disclosing that a wire transfer was fraudulently authorized carries serious reputational consequences.

Vendor and Invoice Fraud

A variant of BEC that targets accounts payable. An attacker spoofs a supplier's email address and sends an updated invoice with new banking details. The payment clears through normal approval channels. By the time the legitimate supplier follows up on the outstanding balance, the funds are gone and the paper trail points to an internal process failure.

Whaling

Spear phishing directed specifically at senior executives: CEOs, CFOs, board members, and legal counsel. The premise is that access to an executive's account or credentials unlocks far more than any standard employee account. Attackers invest substantially more time in research for these attempts, often referencing real board meetings, active deals, and recently published financial disclosures to make the message credible.

Credential Harvesting At Scale

Not every phishing attack is immediately financial. A significant portion targets employee credentials to gain a foothold inside internal systems: cloud platforms, admin panels, CRM databases, HR tools. A compromised account from a mid-level employee can serve as the entry point for a far larger intrusion. The account may look unremarkable. What sits behind it often is not.

Social Media Impersonation and Brand Abuse

Attackers do not always go through your employees. Many go around them entirely, targeting your customers by impersonating your organization on social media. Fake Facebook pages, cloned executive profiles, and fraudulent customer support accounts are used to collect credentials, push malicious links, or solicit payments from people who believe they are dealing with a legitimate business. In the Philippines, fake brand and executive profiles rose 37% in 2025, reaching 1,291 documented cases. A convincing fake page can operate for days before anyone reports it. During that window, your customers are being defrauded under your name.

The common thread: the employee is not the end target. They are the entry point.

Why Employees Are the Attack Surface

Security awareness training is built on the assumption that phishing will be obvious enough to catch. In 2025, that assumption is no longer reliable.

AI-powered spear phishing allows attackers to construct highly personalized messages using data pulled from LinkedIn profiles, company websites, press releases, and org charts. A message that references a real project, uses the recipient's name, mirrors a colleague's writing style, and arrives from a domain that differs from the real one by a single character is not something standard phishing training is designed to intercept. It bypasses awareness because it is built to look exactly like normal internal communication.

Role-based targeting has become standard practice at the business level. Finance teams receive fraudulent wire transfer requests timed to busy periods. HR teams are sent payroll diversion emails that redirect salary payments to attacker-controlled accounts. IT administrators receive fake security alerts engineered to harvest credentials with elevated system access. Each attack is built around how that specific role communicates and what actions they are authorized to take.

According to Verizon's 2024 Data Breach Investigations Report, 74% of all breaches involved a human element, whether through error, misuse, or social engineering. That figure has remained consistent across multiple years of the report, which means the human layer is not improving at the rate the threat is advancing.

Training alone is insufficient. The question is not whether someone in your organization will eventually act on a convincing phishing message. It is whether your controls are built to limit what that moment costs.

What It Actually Costs When It Works

Direct Financial Loss. BEC fraud is difficult to recover from once a transfer clears. Financial institutions can sometimes intervene if the fraud is reported within hours, but recovery rates drop sharply after the first 24 hours. In the Philippines, account takeover incidents reached 3,104 cases in 2025, resulting in PHP 409 million in damages, and those are only the reported cases.

Regulatory Exposure. The Data Privacy Act of 2012 requires organizations to notify the National Privacy Commission and affected individuals within 72 hours of discovering a breach likely to cause harm. Penalties for grave infractions include imprisonment of 1.5 to 5 years, fines up to PHP 1,000,000, and an administrative fine of up to 3% of the organization's annual gross income. The Anti-Financial Account Scamming Act (AFASA) extends this further, holding organizations accountable for negligence in protecting customer data against phishing-enabled fraud. For businesses that handle payment data under PCI DSS or health records under HIPAA, the international compliance obligations compound on top of local requirements.

Incident Response and Recovery. The IBM 2024 Cost of a Data Breach Report puts the global average cost of a data breach at $4.88 million, with forensics alone averaging $1.63 million per incident. Seventy percent of organizations studied reported significant or moderate operational disruption. In the Philippines, phishing sites grew 423% in a single year, and third-party breach incidents jumped from 8 to 29. Recovery costs accumulate across legal counsel, external forensics, regulatory filings, customer notifications, and lost business during downtime, regardless of where the breach originates.

Customer Trust. A breach is not just an IT incident. It is a public record of how seriously an organization took that responsibility. In the Philippines, 72% of Filipino consumers were targeted by digital fraud in the first five months of 2026 alone. Customers who lose confidence in a business rarely announce it. They simply leave.

What Businesses Should Actually Do

These are organizational decisions, not individual habits. They require investment, process design, and leadership buy-in.

Technical controls that reduce the attack surface.

Email authentication standards like DMARC, DKIM, and SPF make it significantly harder for attackers to spoof your domain in outbound phishing campaigns. Organizations that have not implemented all three are leaving a basic and well-documented attack vector open. Multi-factor authentication across all accounts, combined with phishing-resistant single sign-on, removes a large class of credential-harvesting attacks from the realistic threat model. These controls do not require large budgets. They require prioritization.

Process controls for high-risk transactions.

Wire transfer fraud and payroll diversion succeed because organizational processes allow a single person to act on a single instruction from a single channel. Dual-approval requirements for financial transactions above a defined threshold, combined with out-of-band verification for any change to payment details, directly address the scenario that costs businesses billions every year. These are not security measures. They are risk management decisions that belong in finance policy.

Role-specific training, not one-size-fits-all.

Finance teams should be trained on BEC and invoice fraud scenarios. HR teams should understand payroll diversion. Executives should receive whaling-specific guidance. IT administrators need to recognize credential-harvesting attempts targeting privileged access. Training mapped to the actual risk profile of each role produces measurably better outcomes than a single annual awareness program sent to everyone.

Test all of it continuously, not once a year.

Controls degrade over time. Systems change, access permissions expand, and new tools get added without always being evaluated for security implications. A single annual audit captures a point in time. The threat does not pause between assessments. Many organizations address phishing through awareness training and policy updates, but validating whether those controls hold under realistic attack conditions requires penetration testing that includes social engineering vectors, and continuous vulnerability discovery that surfaces findings before attackers do.

The Business Risk Framing That Changes Everything

Phishing is not an IT problem. It is a business risk problem that happens to arrive through technology.

Organizations that treat it as an IT problem delegate the response to a security team, check the annual training box, and move on. Organizations that treat it as a business risk problem ask harder questions: What is the realistic cost of a successful BEC incident? What are the regulatory obligations if customer credentials are compromised? What does the business look like six months after a publicly disclosed breach?

The ones asking those questions tend to be the ones running layered defenses, continuous testing, and active disclosure programs. They are also the ones that contain incidents rather than headline them.

Phishing succeeds when organizations assume their controls are working without ever validating them. Realistic security assessments, human-led penetration testing, and continuous vulnerability discovery help close that gap before attackers find it.

At Secuna, that is what we are built for. Secuna Pentest tests your systems the way attackers actually would, including social engineering vectors that standard technical assessments do not cover. Secuna Hunt provides continuous discovery of vulnerabilities before they become entry points, through a managed network of vetted security researchers working against your real attack surface.

Talk to the Secuna team at sales@secuna.io or explore more at secuna.io.

Sources: Phishing & Smishing Surge, Check Point Research via SecurityBrief Asia · FBI IC3 2024 Annual Report · FBI: BEC, The $55 Billion Scam · Abnormal AI: 2024 FBI IC3 Report Breakdown · Verizon 2024 Data Breach Investigations Report · IBM 2024 Cost of a Data Breach Report · Account Takeover Fraud Philippines, Tookitaki · Phishing Sites in PH Jump 423%, Newsbytes PH · Philippines Data Privacy Act of 2012, Security Boulevard · AFASA Philippines, IPID Tech · TransUnion PH Digital Fraud Report May 2026, Philstar

Your phone vibrates. A message from what looks like your bank says a transaction has been flagged and your account will be locked in 30 minutes unless you verify it. The logo is right. The sender name is familiar. You have 30 seconds before your next meeting starts.

That is all a phishing attack needs.

Cyberattacks are often discussed as a business problem: breached systems, leaked databases, ransomware demands made to IT departments. But the most common form of cyberattack does not target a system first. It targets a person.

Phishing is how the majority of cyberattacks begin. It is a message designed to earn a moment of trust, just long enough for you to click a link, enter a password, or transfer money. And in 2025, it cost people and organizations an estimated $442 billion globally, according to the Global Anti-Scam Alliance's annual scam landscape report.

In our previous blog, we covered how AI has compressed the cost and effort of running a cyberattack. Phishing is where that shift is most visible at the individual level. The attacks are more convincing, more personalized, and arrive through more channels than most people are prepared for. This piece breaks down how, and what you can do about it.

How Big the Problem Actually Is

The Global Anti-Scam Alliance surveyed 46,000 adults across 42 countries and found that 57% were scammed in 2025. Of those, 23% lost money. Phishing sits at the center of most of those incidents. It is consistently the most common initial method attackers use, regardless of region, industry, or target.

Since AI became widely accessible, phishing message volume has increased by more than 1,200%. That figure reflects how cheap and fast it has become to generate convincing, targeted messages at scale. Researchers tracked 3.8 million phishing attacks globally in 2025, and that only covers monitored, reported incidents.

The Philippines sits firmly within this global trend. The country recorded 3,824 phishing websites in 2025, up 423% from the year before. A TransUnion report from May 2026 found that 72% of Filipino consumers were targeted by digital fraud in just five months, marking the sixth consecutive year the country's fraud rate exceeded the global average. Among those targeted, phishing was the most commonly reported scheme at 45%, followed by smishing (phishing via text message) at 38%.

What Phishing Looks Like Today

The mental image most people have of a phishing attempt (a badly written email, a suspicious link, an implausible story) reflects attacks from a decade ago. The standard has shifted considerably.

SMS and messaging apps. Smishing, or phishing delivered by text, has become one of the most effective attack channels globally. The messages are short and look entirely routine. A typical one might read:

GCash: Your account has been temporarily limited due to suspicious activity. Verify your identity within the next hour to restore access: [link]

In the United States alone, consumers reported $470 million in losses to text scams in 2024, five times the 2020 figure. Globally, smishing incidents spiked 328% in a single year. Messages impersonate banks, delivery services, government agencies, and payment platforms. They create urgency: a flagged transaction, a held delivery, an account about to be locked. And they work because the urgency overrides the pause that skepticism requires. In the Philippines, campaigns impersonating GCash, BDO, and Landbank have become persistent enough that the BSP issued a specific public advisory: legitimate financial institutions will never ask for your OTP or password through a text message or link.

Fake login pages. Modern phishing pages replicate the branding, layout, and even the security indicators of real platforms closely enough that careful users are still deceived. You might notice the URL looks slightly off, but the padlock icon is there and the page loads instantly. The credentials entered on it go directly to the attacker. These pages are available as ready-made kits and can be deployed in minutes, which is part of why phishing site volumes have grown so sharply.

Social media impersonation. Fake brand and executive profiles use AI-powered chatbots to maintain conversations, promote fraudulent investment opportunities, and direct people to malicious pages. They are often close enough to the real account to pass a quick visual check. The Global Anti-Scam Alliance identifies online communities (social media, dating platforms, forums) as one of the highest-fraud categories globally. In the Philippines, fake brand and executive profiles rose 37% in 2025, from 940 to 1,291 documented cases.

Deepfakes. AI-generated video and audio have made it possible to fabricate a convincing likeness of almost anyone: a public figure endorsing an investment, a company executive authorizing a transfer, a familiar face asking for trust. In Q1 2025 alone, deepfake-enabled fraud caused over $200 million in losses globally, with these attacks rising 1,633% versus the prior quarter. In the Philippines, documented cases include fabricated videos of public figures used to promote fraudulent investment schemes, with production quality high enough to clear the threshold of doubt for careful viewers. To be clear, deepfakes are not yet the dominant phishing tactic. Traditional smishing and fake login pages still account for the majority of successful attacks because they are cheaper to run and just as effective. But deepfakes represent the fastest-growing segment, and the cases that involve them tend to involve significantly larger losses.

Romance and trust scams. Not all phishing is fast. Some of the most damaging attacks are built over weeks: a profile, a relationship, a manufactured sense of trust, before any request is made. AI has made this approach significantly more scalable, enabling automated conversations across thousands of targets simultaneously. In the Philippines, AI-powered love scams led to over P20 million in recovered losses in 2025. Global losses to romance scams run into the billions annually.

Why the Old Signals No Longer Work

The conventional checklist for spotting phishing (look for typos, distrust urgency, check the sender address) was built for a different threat environment. It assumed that phishing was low-effort and therefore obviously imperfect.

As we discussed in our previous blog, AI has removed most of those imperfections. Messages are now grammatically clean, contextually relevant, and personalized using publicly available information. A text that references your actual bank, your region, and a transaction type you regularly make does not register the same alarm as "URGENT: Your account has been COMPROMISED." The signals that used to give phishing away have been engineered out.

The more useful question is not: does this look suspicious?

It is: was I expecting this?

What Reduces Your Risk

None of these require technical knowledge. They reflect how attackers actually operate, and where the weak points are.

Treat urgency as a signal, not a reason to act. Phishing consistently relies on compressing the time between receiving a message and responding to it. A message that tells you your account will be locked, your funds held, or your delivery cancelled unless you act now is worth slowing down for. Legitimate platforms do not rely on that kind of pressure.

Go to the source, not the link. If a message claims there is an issue with your account, open the app or navigate to the platform directly. Do not use the link in the message. Any real issue will be visible when you get there.

Turn on multi-factor authentication. When a login requires a second step beyond your password, like a code from an app or a biometric check, a stolen password alone cannot get an attacker in. The BSP, the National Privacy Commission, and the US Federal Trade Commission all identify this as one of the most effective individual protections available.

Apply more scrutiny where the stakes are higher. A video of a public figure endorsing an investment. A message from someone you only know online asking you to move money. A prize notification for something you did not enter. The threshold for verification should be proportional to what is being asked. For anything involving money or credentials, check through a separate channel before acting.

Report what you encounter. Reporting suspicious messages and accounts through platform tools matters. It accelerates takedowns of active campaigns and feeds into the databases law enforcement uses to track organized fraud operations. In the Philippines, the Anti-Financial Account Scamming Act (AFASA) now criminalizes phishing, smishing, and vishing, giving reports direct legal weight.

The Individual and the Larger System

The safest habit in 2026 is not spotting every scam. It is slowing down before you act on one.

Phishing does not begin and end with one person. Every set of credentials captured through a phishing attack is a potential entry point into something larger: a business, a platform, a system that other people depend on. The organizations and apps that handle your data have a responsibility in this too.

In our next blog, we look at the business side: what phishing means for companies handling customer data online, where their exposure lies, and what they need to do about it.

For more on how Secuna helps organizations protect the people who trust them, visit secuna.io.

Sources: Global Scam Landscape 2025, ScamWatchHQ · Phishing Statistics 2026, Axis Intelligence · Phishing Trends 2025–2026, CaptainDNS · Phishing Attacks Up 1,200%, World Economic Forum · Check Point Research: 423% Phishing Surge PH · TransUnion PH Digital Fraud Report, May 2026 · Phishing & Smishing Surge, Check Point PH · Deepfake Statistics 2025, DeepStrike · GMA News: Doctor Loses P93M to Deepfake Scam · AI-Powered Love Scams, PIA · AFASA Philippines

Cyberattacks have long affected both organizations and individuals around the world. From phishing scams and social engineering attacks to ransomware and data breaches, cybercriminals have continuously adapted their tactics to exploit new technologies and changing behaviors.

The rise of artificial intelligence (AI) has accelerated that evolution. Tasks that once required significant time, technical expertise, and manual effort can now be completed more quickly and at greater scale. Phishing messages are becoming more convincing, scams more personalized, and attacks easier to execute.

While these developments are playing out globally, their impact is increasingly visible at the local level. In the Philippines, AI-assisted scams, phishing campaigns, and automated cyberattacks reflect many of the same trends shaping the global threat landscape, offering a closer look at how these threats affect both consumers and businesses.

In this article, we break down how AI has rewritten the rules of cyberattacks, what it looks like for consumers and businesses in the Philippines, and why the two sides of this problem are more connected than most people realize.

What AI Changed About Cyberattacks

Cyberattacks used to require a combination of technical skill, time, and patience. An attacker had to manually identify a target, research it, craft a believable approach, and find a way in. That process was slow enough that a reasonably alert person or organization had a chance to notice something was wrong.

Here is what a realistic attack timeline looked like before AI:

• Days 1 to 3: Manual reconnaissance. Research the target, find exposed systems, map the attack surface.
• Days 4 to 7: Craft the approach. Write phishing emails, build lures, source or develop the tools.
• Days 8 to 14: Execute carefully. Move slowly to avoid triggering alerts.
• Week 3 onward: Wait for credentials, escalate access, and move toward the objective.

With AI, that entire sequence now takes under 48 hours.

AI handles reconnaissance in minutes: scraping websites, mapping exposed systems, and identifying software versions before a human attacker has even opened a browser. Phishing messages that used to be caught by poor grammar or generic phrasing are now personalized, contextually specific, and built from publicly available data about the target. Tools that previously required deep technical skill can now be assembled with AI assistance.

The numbers reflect how much ground has already been lost. For organizations and government agencies, Fortinet's 2026 global threat report recorded a 389% increase in ransomware victims linked to AI-enabled cybercrime. Ransomware locks victims out of their own systems and demands payment for access to be restored.

For everyday consumers, the equivalent is phishing. Check Point Research documented a 423% surge in phishing sites targeting the Philippines in 2025 alone. These are fake pages built to steal credentials, banking details, and personal information from individuals. Both numbers point to the same shift: AI has made it economically viable to run attacks at a scale that was not possible before.

What This Looks Like for Consumers

For many Filipinos, AI-assisted attacks arrive through the platforms they use every day: text messages, email, social media, and messaging apps.

Smishing (SMS-based phishing) has become the dominant threat vector in the Philippines. Messages impersonating GCash, BDO, Landbank, or courier services like J&T and LBC are now generated at scale, personalized using publicly available data, and sent in volumes that make filtering difficult. The messages do not look like scams. They look like legitimate notifications, because they were built to.

Deepfake technology has added a layer that most people are not prepared for. In 2025, a Filipino doctor lost ₱93 million to an investment scam built around an AI-generated video of President Marcos. The video was convincing enough to override skepticism because the production quality was high enough to clear the threshold of doubt. The same technology is being used in love scams, fake job recruitment, and celebrity-endorsed investment fraud targeting everyday consumers.

AI-powered love scams alone resulted in victims recovering over P20 million in 2025, with P1.2 million recovered in January 2026 alone. These are not unsophisticated operations. They use automated conversations, staged video calls, and fabricated profiles built to establish trust over weeks before the actual deception happens.

For consumers, the practical risk is this: the signals that used to indicate a scam (poor grammar, generic greetings, suspicious links) are no longer reliable. AI has neutralized those signals. What used to be a gut-check is now a judgment call that requires more deliberate scrutiny.

What This Looks Like for Businesses

For businesses, the impact operates at a different scale but follows the same logic: AI has made attacks faster, more targeted, and harder to anticipate.

The entry point is often a person, not a system. A finance officer who receives a well-crafted phishing email, a customer service agent who clicks a malicious link, an executive whose voice is cloned to authorize a fraudulent transaction: these are not edge cases. They are documented patterns appearing across Philippine organizations right now. And they are effective precisely because they bypass technical defenses by targeting human judgment instead.

The exposure extends beyond people to public-facing systems. Websites, login portals, mobile apps, and APIs are continuously being probed by automated tools looking for exploitable weaknesses. A vulnerability disclosed today can be actively exploited within hours, before most security teams have had a chance to assess whether they are affected.

A Fortinet study published in May 2026 found that 57% of Philippine organizations now identify AI-driven cyberattacks as a primary concern. Only 16% have reached an advanced security posture, meaning the majority of local businesses are facing a faster, more automated threat environment with defenses that have not kept pace.

In the third quarter of 2025 alone, over 52 million Filipino user credentials were exposed across dozens of breach incidents, a 49% increase from the prior quarter. Those credentials came from organizations across fintech, retail, healthcare, and local government. The DICT reported that more than 20,000 vulnerabilities were exploited by organized threat groups during this period, affecting agencies including DENR, DA, and the Philippine Coast Guard.

The scale of exposure is no longer hypothetical. It is already documented.

The Connection Between the Two

Consumer-facing attacks and business-facing attacks are not separate problems. They feed each other.

When a consumer's credentials are exposed in a phishing attack, those credentials are often used to access business platforms, internal systems, or corporate accounts. When a business fails to secure its customer-facing app, it exposes the personal data of thousands of consumers who trusted it with their information.

The Philippine Data Privacy Act of 2012 places legal obligations on organizations to protect the personal data of their customers. AI-assisted breaches that expose that data are not just a security problem. They carry compliance consequences, regulatory scrutiny from the National Privacy Commission, and reputational damage that is difficult to recover from.

This is why the conversation about AI and cyberattacks cannot be siloed. Businesses that understand the consumer-level threat are better at anticipating how their own systems become entry points. Consumers who understand the business-level exposure are better at recognizing when their personal information has been put at risk by a company they trusted.

What This Means Going Forward

The Philippine government has responded. President Marcos approved a National Cybersecurity Plan. The DICT and the House ICT Committee are advancing a Cybersecurity Act with mandatory incident reporting requirements. The NPC's 2026 Privacy Awareness Week centered on responsible AI governance as a core data protection obligation.

These are signals that the compliance bar is being raised. Organizations that wait for enforcement to act will already be behind. The gap between where most Philippine businesses are today (with only 16% at an advanced security posture) and where regulations are heading is not a comfortable one to sit in.

The rise of AI has not changed what cybercriminals want. They still seek access to systems, sensitive data, and financial assets. What has changed is how efficiently they can pursue those goals. As AI continues to evolve, both organizations and individuals will need to rethink the assumptions they use to identify and respond to cyber threats.

For businesses, the practical question is not whether AI-driven threats are real. The data makes that clear. The question is whether your current approach to security testing gives you visibility into your exposure before an attacker finds it first.

If your organization is ready to assess where it stands, reach out to the Secuna team at sales@secuna.io or visit secuna.io.

Sources: Fortinet 2026 Threat Report · Fortinet/IDC PH Study, May 2026 · Check Point Research: 423% Phishing Surge · 52M Credentials Exposed, Q3 2025 · AI-Powered Love Scams · PNA: AI Threats Outpacing PH Readiness · National Cybersecurity Plan · DICT Cybersecurity Act Push · NPC PAW 2026 · Phishing & Smishing Surge

Bug Bounty Hunting and Penetration Testing have evolved dramatically, with security landscapes constantly shifting as attackers and defenders adapt to new technologies and strategies. What once worked in traditional security assessments is no longer enough, as organizations implement stronger defenses, patch vulnerabilities faster, and expand their infrastructure to cloud-based and AI-driven systems. As a result, modern ethical hackers or hunters must go beyond conventional techniques, sharpening their expertise and adopting innovative methods to stay ahead of the game.

To maximize their effectiveness, hunters need to refine their skills, automate reconnaissance and exploitation processes, and leverage cutting-edge technologies like AI and cloud security testing. By continuously learning and evolving, hunters can uncover vulnerabilities that others might overlook, giving them a competitive edge in the bug bounty space.

In this blog, we’ll dive into some of the most advanced techniques in bug bounty hunting—straight from Secuna’s in-house hunters. These insights, gained through real-world experience, cover OSINT for historical data analysis, custom exploit development, cloud and container exploitation, AI-assisted pentesting, and automated reconnaissance. By adopting these proven techniques, hunters can significantly enhance their approach to security testing and discover high-impact vulnerabilities more effectively.

Weaponizing Old Information Through OSINT

One of the most overlooked yet powerful techniques in bug hunting is Open-Source Intelligence (OSINT). Many organizations have decade-old systems that still contain publicly accessible sensitive information, often due to poor security practices in the past.

Where to Look for Old Exposed Data:

• Wayback Machine & Archive.org – Older versions of websites may expose forgotten endpoints, sensitive files, or internal documents.
• Google Dorks – Advanced search operators can reveal exposed credentials, configurations, and private documents that shouldn’t be indexed.
• Old Forums & Developer Repositories – Public forums and code repositories may contain hardcoded API keys, internal documentation, or vulnerabilities that were never patched.

By combining historical reconnaissance with modern enumeration techniques, hunters can uncover security flaws that organizations may have long forgotten.

Mastering Scripting & Exploit Development

Many hunters rely solely on publicly available exploits, but those who can write their own scripts and develop custom exploits gain a significant advantage. Writing your own tools:

• Helps you understand vulnerabilities on a deeper level.
• Allows you to bypass common security patches where public exploits may fail.
• Gives you the flexibility to craft tailored exploits for unique environments.

How to Start Developing Exploits:

• Learn Python & Bash for automating reconnaissance and simple exploits.
• Study existing exploits and try to modify them to work in different scenarios.
• Explore buffer overflows, SQL injections, and RCE techniques to gain a strong foundation.
• Build your own enumeration tools to automate scanning and data extraction.

Being able to modify or create your own exploits will set you apart from other hunters and make you more effective in targeting real-world applications.

Cloud & Container Exploitation

With cloud computing dominating the tech landscape, cloud security misconfigurations have become one of the biggest attack surfaces. A majority of companies now use AWS, Azure, or GCP, meaning cloud exploitation skills are crucial for modern bug hunters.

Common Cloud Exploits:

• AWS & Azure Enumeration – Exploiting overly permissive IAM roles and misconfigured cloud storage.
• Container Breakouts – Taking advantage of misconfigured Docker, Kubernetes, or LXC environments to escape containerized restrictions.
• SSRF to Cloud Metadata Service – Exploiting Server-Side Request Forgery (SSRF) vulnerabilities to extract sensitive cloud credentials via 169.254.169.254.
• CI/CD Pipeline Attacks – Injecting malicious code into automated deployments to gain access to sensitive infrastructure.

Cloud security is a growing attack surface, and understanding how cloud services work will make your bug hunting skills far more valuable.

Leveraging AI & Machine Learning for Pentesting

Artificial Intelligence is reshaping cybersecurity, and ethical hackers can now use AI-powered tools to enhance reconnaissance, automate exploit development, and perform large-scale code analysis.

How AI Can Assist in Pentesting:

• Automated Exploitation with AI – Using Large Language Models (LLMs) to generate payloads for fuzzing or SQL injection attacks.
• AI-Assisted Code Audits – Tools like GPT-based analyzers can review codebases to identify security flaws, logic bugs, and vulnerabilities faster than traditional methods.
• Malware Generation & Evasion – AI can assist in understanding and simulating real-world attack techniques used by threat actors.

AI isn’t replacing security researchers—it’s amplifying their capabilities. Ethical hackers who integrate AI into their workflow will be far more efficient in identifying and exploiting vulnerabilities.

Automating Reconnaissance for Faster Bug Discovery

Reconnaissance is the foundation of every successful bug hunt. The more efficiently you can gather intelligence on a target, the faster you’ll find vulnerabilities. Automating recon can significantly boost productivity and help you identify attack surfaces more quickly.

Essential Tools for Recon Automation:

• Asset Discovery: amass, naabu, subfinder
• JS Enumeration: lazyeggs, JSLinkFinder, LinkFinder
• Web Crawling & Archive Analysis: wayback, GAU, Katana
• Service & Device Scanning: Shodan, Censys

Why Recon Automation Matters:

• Helps identify outdated frameworks and backend technologies used by the target.
• Quickly maps out API endpoints and web services.
• Saves countless hours manually searching for attack surfaces.

The more efficiently you can gather information about a target, the better prepared you’ll be to find vulnerabilities before anyone else.

FINAL THOUGHTS

Bug hunting and ethical hacking are an ever-evolving field, and those who stay ahead of the curve will always have an advantage. By expanding your skillset in OSINT, scripting, cloud security, AI-assisted pentesting, and automated recon, you’ll become a far more effective hunter.

If you want to stand out in the ethical hacking community, focus on:
✅ Uncovering old security flaws using OSINT
✅ Developing your own exploits instead of relying on public ones
✅ Mastering cloud & container security as cloud adoption grows
✅ Leveraging AI to automate vulnerability research
✅ Speeding up your recon process to gain an edge over competitors

By adopting these advanced techniques, you’ll increase your chances of finding high-impact vulnerabilities and elevating your bug bounty career to the next level.

Join our in-house hunters on their journey of expanding skillsets and widening collaborations! Register as Secuna Hunter here: https://platform.secuna.io/signup/hunter

Just as trust strengthens relationships, robust security is essential for a thriving business. With cyber threats continuously advancing, companies of all sizes must stay vigilant to protect their assets. A single cyberattack can lead to financial losses, reputational damage, and even legal consequences. That’s why understanding the basics of cybersecurity is crucial for protecting your business, your clients, and your future.

Check out the Cybersecurity & Infrastructure Security Agency (CISA) website for an overview of the current cyber threat landscape.

Common Cyber Threats That Put Businesses at Risk

As businesses become more reliant on digital systems, cybercriminals are constantly evolving their tactics to exploit vulnerabilities. Whether targeting small startups or large enterprises, hackers use a variety of sophisticated and deceptive techniques to compromise business security.

Understanding these common cyber threats is the first step in defending against them. Here are some of the most dangerous threats businesses face today:

Phishing Attacks

Phishing is a deceptive tactic where attackers impersonate legitimate organizations through emails, messages, or websites to trick employees into revealing confidential information. These attacks often use urgency and fear to manipulate victims.

Ransomware Attacks

This type of malware encrypts an organization’s files, rendering them inaccessible until a ransom is paid. Ransomware can cripple business operations, cause severe financial loss, and even lead to permanent data loss if backups are unavailable.

Insider Threats

These threats originate from within the organization—whether from employees, contractors, or business partners—who may accidentally or intentionally compromise security. Insider threats can result from negligence, lack of cybersecurity awareness, or malicious intent.

Cybersecurity Mistakes Businesses Must Avoid

Even well-meaning businesses can fall into cybersecurity traps that leave them vulnerable to attacks. Cybercriminals are constantly evolving their tactics and small missteps—whether due to oversight, lack of awareness, or resource constraints—can lead to devastating breaches, financial losses, and reputational damage. To build a resilient security posture, businesses must be proactive in addressing common pitfalls. Here are some of the most frequent and costly cybersecurity mistakes to avoid:

• Ignoring Software Updates and Patches: Every software update comes with security fixes designed to close vulnerabilities that hackers can exploit. Businesses that delay or ignore these updates are essentially leaving their digital doors unlocked, inviting cybercriminals to exploit known weaknesses. Ransomware attacks, data breaches, and system takeovers often stem from outdated software.
• Using Weak or Reused Passwords: Weak passwords remain one of the easiest ways for hackers to gain unauthorized access. Many cyberattacks exploit stolen or guessed credentials, often obtained through past data breaches. Reusing passwords across multiple accounts further amplifies this risk.
• No Multi-Factor Authentication (MFA): A single password is no longer enough to protect sensitive data. Without MFA, a compromised password can give attackers full access to business systems, customer data, and financial records. Multi-factor authentication adds an extra layer of security by requiring a second form of verification, such as a fingerprint scan, a one-time passcode, or a security key.
• Lack of Cybersecurity Training for Employees: Employees are the first—and often the last—line of defense against cyber threats. However, without proper training, they can inadvertently become an organization's weakest link. Phishing emails, social engineering tactics, and malicious links are common entry points for cyberattacks.
• No Incident Response Plan: Cyberattacks are no longer a question of if but when. Without a well-defined incident response plan, even a minor security breach can escalate into a full-scale crisis. A lack of preparation can lead to delayed responses, increased data loss, prolonged system downtime, and regulatory penalties. Businesses should establish a structured response strategy that includes threat identification, containment, mitigation, and recovery protocols.
• Not Investing in Proactive Cybersecurity: Many businesses take a reactive approach to cybersecurity, only addressing threats after an attack has occurred. This can lead to significant financial and operational damage. Proactive security measures—such as continuous monitoring, penetration testing, threat intelligence, and security automation—help businesses identify and mitigate risks before they become full-blown attacks.

First Steps to Strengthen Your Business Security

Taking proactive steps toward cybersecurity can make a significant difference. While no system is 100% immune to attacks, implementing strong cybersecurity measures early on can significantly reduce risks. By prioritizing security from the start, businesses can build a resilient foundation that protects sensitive data, customers, and long-term success. Here are the key first steps every business should take to strengthen its cybersecurity posture:

• Back-Up Important Data Regularly: Regularly back up critical data to ensure that you can quickly recover in the event of an attack or system failure. Use a combination of cloud-based and offline backups, follow the 3-2-1 backup rule (three copies of data, two on different storage media, one offsite), and test backups frequently to verify their integrity.
• Enforce Strong Password Policies: Require employees to use strong, unique passwords for each account and encourage the use of password managers to store and generate complex credentials. Implementing password policies, such as mandatory password rotation and length requirements, further strengthens account security.
• Implement Multi-Factor Authentication (MFA): MFA adds an essential extra layer of protection by requiring a second form of verification, such as a one-time code, biometric authentication, or a security key. This reduces the likelihood of unauthorized access, even if passwords are compromised.
• Educate Employees on Cybersecurity Best Practices: Regular cybersecurity training ensures employees can recognize threats, follow best practices, and respond appropriately to suspicious activity. Implementing security awareness programs, phishing simulations, and clear security policies can greatly reduce the risk of insider-related breaches.
• Limit Access to Sensitive Data: Not every employee needs access to all business data. Implementing role-based access controls (RBAC) ensures that employees only have access to the information necessary for their roles. Regularly review access permissions and revoke credentials for former employees to minimize insider threats.
• Develop an Incident Response Plan: Having an incident response plan ensures that your team knows how to react quickly and effectively in the event of a breach. A well-defined plan should outline roles, communication protocols, containment strategies, and recovery procedures. Conducting regular incident response drills prepares employees to act decisively when security incidents occur.
• Work with Security Professionals to Identify Vulnerabilities: Conducting vulnerability assessments, penetration testing, and security audits can help detect weaknesses before attackers exploit them. Partnering with cybersecurity experts ensures that risks are identified and mitigated before they escalate. At Secuna, we specialize in helping businesses enhance their security posture through proactive security testing and expert guidance. Identifying vulnerabilities early can mean the difference between staying secure and suffering a costly breach.

Secure Your Business Before It’s Too Late

Cybersecurity isn’t just an IT concern—it’s a critical business priority that affects every aspect of your organization, from operations to reputation, and ultimately your bottom line. In today’s interconnected world, cyber threats are no longer something that only large corporations need to worry about—small and medium-sized businesses are increasingly targeted as well.

All businesses must keep in mind that cybersecurity isn’t a one-time fix; it’s an ongoing process that requires constant vigilance and adaptation. As cybercriminals become more sophisticated, your security measures must keep pace. Regular audits, updates, and employee education are crucial to staying one step ahead of potential threats.

Evaluate your current security measures, train your employees to recognize potential threats, and partner with cybersecurity professionals to identify and address vulnerabilities before they are exploited. Don’t wait for a breach to prompt change—by acting now, you’ll prevent future headaches and safeguard your business.

If you need expert guidance, Secuna is here to provide proactive, tailored security solutions that fit your unique needs. Contact us at sales@secuna.io today!

Stay tuned for this week’s deep dive into Committing to Cybersecurity! Follow us on Facebook, LinkedIn, Instagram, and X for more insights and updates.

Reflecting on the cybersecurity landscape of 2024, ethical hackers emerge as pivotal figures in the fight against ever-evolving digital threats. Often referred to as “white hats” or “hunters,” these professionals have risen to prominence, using their expertise to anticipate and counteract malicious cyber activity. In a year marked by groundbreaking technological advancements and increasingly sophisticated attack vectors, ethical hackers have been at the forefront of defending businesses, individuals, and critical infrastructures. From combating AI-driven cyberattacks to addressing the growing threats of hacking-as-a-service platforms and deepfake technologies, 2024 underscored their essential role in navigating a complex and dynamic digital environment.

Notable Developments in 2024

Surging Demand for Ethical Hackers

There has been a significant global surge in the demand for ethical hackers, driven by the urgent need to counteract cybercriminals who use similar techniques for malicious purposes, with regions like India seeing a notable increase in this demand. Ethical hackers, often referred to as white hats, leverage their expertise to protect and strengthen digital infrastructures against evolving threats.

Hacking-as-a-Service and Deepfake Threats

Ethical hackers are increasingly focused on combating the growing threats posed by hacking-as-a-service platforms and the misuse of deepfake technology. These services, often paid for with untraceable cryptocurrency, allow cybercriminals to conduct sophisticated attacks, such as identity theft and fraud, challenging ethical hackers to develop new defense strategies.

AI-Driven Cyberattacks

A significant 83% of ethical hackers reported encountering AI-enhanced cyberattacks in 2024, signaling a shift in attack tactics. This evolution highlights the need for ethical hackers to adapt, as AI not only serves as a tool to improve defense systems but also enhances the complexity of malicious threats.

Ethical Hacking’s Role in Protecting Businesses in 2024

The rise of ethical hacking has been pivotal in safeguarding businesses against cyber threats. Ethical hackers are crucial in identifying vulnerabilities, securing digital assets, and supporting organizations in fortifying their security strategies, underscoring their essential role in modern cybersecurity.

Expansion of Bug Bounty Programs

As organizations recognize the power of crowdsourced security, bug bounty programs saw significant growth in 2024. For example, Microsoft paid $16.6 million to over 340 ethical hackers through its bug bounty programs, reflecting the increasing value placed on their contributions to identifying and addressing security flaws.

Lessons Learned from 2024

1. The Rise of AI in Cybersecurity: AI has become both a powerful attack vector and a critical defense tool in cybersecurity. Ethical hackers face the challenge of countering increasingly sophisticated AI-driven threats, while simultaneously using AI to enhance their capabilities, such as faster threat detection and predictive analysis. This dual role of AI calls for ethical hackers to stay adaptive, balancing defense strategies with evolving attack tactics.
2. Collaboration Matters: Collaboration has become a crucial element in building stronger defenses. Ethical hackers bring a fresh, hands-on perspective to identifying vulnerabilities, while cybersecurity providers offer advanced tools and frameworks to help secure systems. Synergy accelerates response times, improves security measures, and ultimately strengthens the defense against ever-more sophisticated threats. As cyber risks continue to grow, collaboration will be key to staying ahead of cybercriminals.
3. Emerging Threats Require Vigilance: Hacking-as-a-service platforms and the misuse of deepfake technology highlight the increasing accessibility and sophistication of cyber threats. Ethical hackers are on the frontlines of combating these emerging challenges, working to identify and neutralize these threats before they escalate. Adapting quickly to these new risks is vital as malicious actors continue to exploit advanced technologies.
4. Sector-Specific Vulnerabilities: Sectors like automotive and IoT are becoming major targets due to their growing reliance on interconnected systems. Ethical hackers are focusing on identifying vulnerabilities in these areas, from securing autonomous vehicles to protecting smart devices. As these sectors expand, ethical hackers must continue refining their methods to safeguard new technologies and ensure secure integration into everyday life.

Gearing Up for 2025

1. Strengthen Collaboration with Cybersecurity Platforms: Partnerships with cybersecurity platforms like Secuna will be essential for ethical hackers. These platforms offer collaborative environments for identifying vulnerabilities in real-world settings, allowing hackers to sharpen their skills while contributing to the security of organizations.
2. Embrace AI for Enhanced Defense: As AI-driven cyberattacks continue to evolve, ethical hackers must familiarize themselves with AI technologies to enhance their own defense mechanisms. Leveraging AI tools for faster threat detection, anomaly identification, and automating repetitive tasks will be crucial for staying ahead of increasingly sophisticated attackers.
3. Adapt to Emerging Technologies: With the rapid growth of blockchain, quantum computing, and 5G, ethical hackers should focus on understanding the unique vulnerabilities these technologies present. By gaining expertise in these areas, ethical hackers will be better equipped to secure systems and anticipate future threats associated with these innovations.
4. Counter Hacking-as-a-Service Threats: The growing availability of hacking-as-a-service platforms means ethical hackers must develop strategies to identify and neutralize these services. Staying updated on new tactics and learning how to detect these services will be vital to protect organizations from cybercriminals using them for attacks.
5. Focus on Critical Infrastructure Security: As sectors like automotive, IoT, and healthcare become more interconnected, the need for specialized security assessments in these areas will rise. Ethical hackers should focus on these critical industries, honing their expertise to address specific vulnerabilities and provide robust protection for increasingly complex systems.

Conclusion

Looking ahead to 2025, the lessons of 2024 serve as a vital roadmap for ethical hackers and the cybersecurity community. The past year has underscored the importance of adaptability, innovation, and collaboration in the face of increasingly complex and sophisticated cyber threats. The battle against these threats is relentless, and the ethical hacking community stands as a beacon of hope in an increasingly interconnected and vulnerable world.

By embracing cutting-edge tools, refining their skills, and focusing on protecting critical infrastructures, ethical hackers are not just defenders of the digital realm—they are architects of a safer future. Their role in mitigating risks tied to emerging technologies such as AI, blockchain, and quantum computing will be crucial as these innovations continue to reshape the digital landscape. Moreover, their efforts in fostering global partnerships and enhancing cybersecurity awareness will serve as a cornerstone for building a resilient and secure digital ecosystem for all.

Are you ready to join the ranks of ethical hackers shaping the future of cybersecurity? Register and get verified on Secuna’s platform now!

As we move further into 2025, it’s essential to look back at the cybersecurity landscape of 2024. This past year was marked by high-profile breaches, rapid technological advancements, and evolving threats—each serving as a crucial reminder of the ever-changing nature of cyber risks. By analyzing these events, we can draw valuable lessons to fortify defenses and avoid repeating mistakes in the year ahead. In this blog, we’ll review the most significant cybersecurity moments of 2024, the key takeaways, and how businesses can build on these insights to prepare for a more secure and resilient 2025.

2024’s Notable Cybersecurity Highlights

High-Profile Cyberattacks

• Cybersecurity Threats to Government Infrastructure: In May 2024, the hacker group “DeathNote” launched a highly destructive cyberattack that compromised sensitive data from 31 government and private entities across the Philippines. The breach exposed a range of personal, financial, and government-related information, sparking widespread concern over the vulnerability of critical infrastructure. This incident underlines the importance of comprehensive cybersecurity frameworks to prevent such large-scale breaches in the future.

• Financial Systems at Risk: In 2024, fintech giant Finastra, which supports many of the world’s largest banks, disclosed a significant cyberattack. This breach impacted financial operations and exposed critical data, underscoring the growing risks faced by financial institutions. The incident highlights the need for enhanced cybersecurity frameworks to safeguard sensitive financial systems and prevent future disruptions in the fintech space.

• The Healthcare Sector Under Siege: In 2024, the United Nations highlighted the growing threat of cyberattacks targeting healthcare systems globally. These attacks not only disrupted patient care and compromised sensitive medical data but also led to significant financial losses for healthcare organizations. The rising impact underscores the urgent need for robust cybersecurity measures to protect critical health infrastructure.

• Cybersecurity Crisis Hits Education: In 2024, a cybersecurity breach within the Philippine Education Ministry exposed over 210,000 records, including sensitive personal and tax information of students. The incident serves as a stark reminder that educational institutions remain prime targets for cyberattacks. It underscores the urgent need for stronger cybersecurity posture to protect students and sensitive information from increasing digital threats in an ever-expanding online environment.

Patch Management and Update Challenges

• Zero-Day Vulnerabilities on the Rise: Zero-day vulnerabilities saw significant exploitation in 2024, becoming a favored tool for cybercriminals targeting enterprise systems. These vulnerabilities, often exploited before patches are available, were used in sophisticated attacks across various sectors. The rise in zero-day exploitation prompted increased efforts in vulnerability management and rapid patch deployment.

• Widespread IT Outage from CrowdStrike Update: In July 2024, a routine update from CrowdStrike caused a significant IT outage, impacting multiple organizations and leading to disruptions across Windows-based systems. The issue stemmed from a logic error in a CrowdStrike Falcon sensor configuration, which affected millions of devices. The incident highlighted the critical need for thorough testing of updates and strong contingency planning to avoid operational downtime and mitigate potential risks to cybersecurity.

Emerging Trends

• AI in Cyberattacks and Defense: 2024 witnessed AI being leveraged for both offense and defense in cybersecurity. Attackers used AI to craft sophisticated deepfakes and manipulate narratives in fake news campaigns, while financial fraud surged with AI-powered scams. On the defense side, AI played a critical role in real-time anomaly detection and phishing prevention.

• Critical Infrastructure Attacks: In 2024, critical infrastructure became an increasingly popular target for cyberattacks. High-profile incidents like the American Water cyberattack and the BianLian ransomware attack on Boston Children’s Hospital highlight vulnerabilities in essential sectors. These attacks serve as a reminder that as industries become more interconnected, the risks to public safety and national security grow. The trend shows that securing operational technology (OT) and strengthening defense measures in these sectors must be a top priority to prevent widespread disruption.

Lessons Learned from 2024

1. Proactive Measures Are Essential: Organizations with robust threat intelligence programs identified risks faster and reduced recovery times. By implementing proactive strategies such as threat monitoring and incident response planning, businesses significantly minimized disruptions and stayed ahead of emerging threats.
2. Employee Awareness Is a Strong Defense: Phishing attacks often exploit human error, making continuous security training vital. Tailored education programs that evolve with emerging threats empower employees to serve as the first line of defense against social engineering tactics and cyber threats.
3. Critical Infrastructure Requires Immediate Attention: Attacks on healthcare and essential services in 2024 exposed the vulnerabilities in critical infrastructure. Strengthening cybersecurity in these sectors is no longer optional—it is a vital step in protecting public health, safety, and national security.
4. Swift Action on Zero-Day Threats Is Crucial: The increasing number of zero-day vulnerabilities in 2024 demonstrated the urgent need for rapid patch deployment and vigilant vulnerability management. Any delay in addressing these weaknesses leaves systems exposed to fast-moving and sophisticated cyberattacks.

Securing the Future in 2025

Invest in Proactive Cybersecurity

• Partner with top-tier cybersecurity providers like Secuna to gain access to advanced technologies and specialized expertise.
• Regularly review and upgrade security infrastructure to proactively address emerging threats and vulnerabilities.

Train and Educate Employees

• Implement ongoing training to ensure employees can recognize phishing attempts and other social engineering tactics.
• Establish clear reporting protocols so employees can quickly escalate suspicious activity, minimizing potential damage.

Back Up Critical Data Frequently

• Automate data backups to ensure consistency and reduce the risk of human error during manual processes.
• Store backups securely offsite to protect data from both cyber incidents and physical disasters.

Regularly Update and Patch Software

• Maintain a routine patch management schedule to address vulnerabilities and reduce exposure to cyber threats.
• Prioritize critical patches to quickly mitigate risks from newly discovered exploits.

Create and Test an Incident Response Plan

• Define clear roles and responsibilities within the plan to ensure a coordinated response during a crisis.
• Regularly test the plan through drills to ensure readiness and identify areas for improvement.

Conclusion

2024 reinforced the ever-present truth that cybersecurity is not just an IT issue but a business imperative. The key takeaways for organizations are clear: prioritize proactive security measures, address vulnerabilities swiftly, and foster a culture of awareness. Businesses that embrace proactive cybersecurity strategies, like regular threat assessments and comprehensive employee training, position themselves to stay ahead of evolving threats.

As we navigate into 2025, the commitment to “Security First” will differentiate resilient businesses from vulnerable ones. By learning from the past and investing in robust strategies, businesses can not only protect their assets but also build trust with their stakeholders.

Want to make sure you have a safe, more secure year ahead? Collaborate with us now!

Launched just two years ago, CodeChum has made significant strides in bridging the gap between academia and tech industry. With partnerships across 70 schools and a growing user base of 15,000 students, CodeChum connects learners with both local and international companies, empowering students to transition from education to employment. As their platform expanded, so did their need for robust cybersecurity to protect sensitive student and institutional data. They recognized that securing their platform was paramount in maintaining trust with their users, schools, and corporate partners.

CodeChum’s increasing responsibility to safeguard sensitive personal information, student performance metrics, and other confidential data brought them to a critical juncture: securing their platform was no longer optional—it was essential.

The Intersection of Education and Cybersecurity

In recent years, the education sector has faced a sharp rise in malware and ransomware attacks globally. According to SonicWall’s 2023 Cyber Threat Report, malware attacks in the education sector surged by 157% in 2022. Similarly, Malwarebytes’ 2024 report labeled 2023 as the “worst year on record” for ransomware in education, with a staggering 70% increase in such attacks.

While digitalization in the education sector remains important and continues to rise amidst these cyber threats, it has become equally essential for Educational Technology (EdTech) platforms like CodeChum to pay important attention to cybersecurity.  As these platforms handle sensitive information, including students’ personal details and performance records, it is crucial to protect these data to preserve user trust and credibility while continuously providing innovative solutions to improve their users’ learning experiences.

By partnering with Secuna, CodeChum has reinforced its commitment to safeguarding the personal information and performance metrics of thousands of students, ensuring that their platform remains secure and trustworthy in an increasingly vulnerable digital world.

CODE to Cybersecurity Commitment

CodeChum’s dedication to cybersecurity and preserving the trust of their clients are reflected in the code of their core principles:

Credibility: CodeChum ensures that their platform remains a trusted resource by implementing rigorous security measures. Their focus on maintaining credibility strengthens relationships with partners and users, proving their commitment to data protection.

Heightened Trust: By partnering with Secuna, CodeChum was able to deliver a Certificate of Cybersecurity Compliance along with other relevant documents to their partners, providing a formal assurance that the platform has been thoroughly tested and secured by a reputable cybersecurity company.

User Protection: Securing their users’ sensitive information is an important priority for CodeChum. By finding and reducing vulnerabilities in their assets, they lessen the risk of exposing their users to data breaches, securing their long-term success and the integrity of their platform.

Mitigating Risks: CodeChum’s approach to cybersecurity is strategic, ensuring that security is not an afterthought but a critical business value, protecting both their platform and their community.

Why Secuna?

Selecting the right cybersecurity partner is pivotal to a platform's security. For CodeChum, this decision was crucial, driven by the urgent need for robust protection and rapid response.

From the outset, CodeChum needed a cybersecurity partner that could deliver quick results while providing extensive asset protection. With their growing user base and sensitive student data, it is imperative to mitigate risks as quickly as possible. Time was of the essence, and the security of their platform was paramount to maintaining their partnerships and user trust.

Secuna quickly stood out as the top choice for several compelling reasons. As the first cybersecurity company recognized by the Department of Information and Communications Technology (DICT) to reach out, Secuna immediately demonstrated its credibility as a proactive and reliable partner in securing organizations. Additionally, Secuna’s deliverables—including a Certificate of Cybersecurity Compliance and a comprehensive, well-documented pentest report—offered significant value to CodeChum, providing the tangible proof of platform security needed to reassure both their partners and users.

The Engagement

The collaboration between CodeChum and Secuna was marked by an efficient and thorough approach to identifying and addressing security vulnerabilities. Here’s a detailed look into the engagement:

• The penetration testing for CodeChum’s programming education platform was done based on frameworks like OWASP WSTG, the Top 10 Web Application Vulnerabilities, and the Top 10 API Weaknesses.
• Secuna’s own methodologies for penetration testing were also applied to CodeChum’s platform.
• Detailed reports were provided in real-time in the Secuna platform, allowing CodeChum to immediately address high-priority items even while the testing was still ongoing.
• Secuna provided unlimited retesting to properly verify the effectiveness of the fixes applied by CodeChum on the discovered vulnerabilities.
• Secuna and CodeChum maintained agile and highly collaborative communication between teams through the Secuna Platform, making remediation and verification of fixes highly efficient.

And these actions yielded the following outcomes:

• The Secuna team submitted the first detailed report within the first 5 hours of the engagement, with reports consistently delivered promptly.
• Among the identified vulnerabilities, two (2) were rated with Critical severity by the Secuna team, one of which had the highest possible severity score on the CVSS.
• The two (2) critical issues were reopened multiple times during the retesting phase, highlighting Secuna’s meticulous fix verification process and CodeChum’s eagerness and diligence in implementing robust fixes for these key vulnerabilities.
• The CodeChum team fixed a total of five (5) vulnerabilities identified by the Secuna team.
• The CodeChum team demonstrated impressive efficiency by resolving the first valid report submission within just 3 days, showcasing their dedication and speed in applying fixes.
• The CodeChum team showed a commendable average remediation time of 2.6 days.
• The CodeChum team met their engagement deadline by swiftly addressing and resolving issues, showcasing the effectiveness of Secuna’s real-time reporting and agile pentesting approach through Secuna’s platform.

Moving Forward

By partnering with Secuna, CodeChum was able to significantly bolster the security of their platform. The vulnerabilities identified during the penetration test were promptly resolved, allowing CodeChum to maintain the trust of their students, schools, and corporate partners. Not only did they fix the immediate issues, but the engagement also led to long-term improvements in CodeChum’s development workflow.

According to CodeChum, while their security practices were already in place, the collaboration with Secuna pushed them to adopt more robust measures, such as conducting regular code security reviews and incorporating additional security tools into their development pipeline. Their successful partnership with Secuna has laid the groundwork for a more secure and reliable platform, which they will continue to build upon.

For organizations that prioritize the safety of their clients, CodeChum’s advice is simple:

“Choose Secuna for your VAPT needs. They align with your business goals and consistently go above and beyond to meet deadlines.”

Secuna remains committed to providing top-tier cybersecurity solutions, helping clients like CodeChum secure their platforms, protect their data, and stay ahead of potential threats.

Want to experience it first-hand? Collaborate with us now!

Introducing LISTA PH
Empowering a thriving community of over 1 million users to achieve their financial aspirations, Lista has transformed the Filipino landscape of financial management since its grand debut in November 2021. With its easy-to-use financial tools, Lista has streamlined the process of managing money, making it effortlessly accessible and seamless for individuals to navigate their financial journeys.

As Lista continues to expand their community and introduce loads of fun features to bring more practical and positive benefits to their users' daily lives, the commitment to protecting their users' data and privacy from digital threats also become their top priority. Recognizing the importance of the trust placed in them by their user base, Lista has teamed up with Secuna. This collaboration involves routine checks and comprehensive testing to ensure that their application, from the main products down to their backend services, is safe and secure.

Changing the Game of Managing Finances
In an era marked by digital transformation, a shift further accelerated by the COVID-19 pandemic, consumers have significantly gravitated towards online channels. In response, companies and industries have swiftly adapted to this changing landscape.

Notably in the Philippines, a prominent shift has been observed in digital payments, with Filipinos increasingly embracing cashless transactions through mobile wallets or card-based payments. Concurrently, organizations, spanning from SMEs to large enterprises, are continuously and proactively seeking ways to align with and adapt to this ongoing digital transformation.

This shift in both individual and organizational behavior presented a great opportunity for Lista to pursue its mission of helping Filipinos keep their finances in check through their handy mobile application. From budgeting and expense tracking to setting and reaching your own financial goals, Lista has become one of the leading apps on financial management in the Philippines.

Listing Cybersecurity Promises
Lista, being committed to guaranteeing the protection and privacy of their users’ data, seeks to deliver this promise by overcoming the following challenges:

• Let users’ data be constantly protected from security vulnerabilities
• Introduce new features consistently while keeping the app also consistently secured
• Secure their infrastructure as they continue to scale, preventing any hiccups that could cause any trouble
• Test API resources thoroughly to ensure that there are no broken authentication or security vulnerabilities introduced to their system
• Achieve regulatory compliance with partners by presenting security testing results

Why Secuna?
Secuna, as a community-powered cybersecurity testing platform, is well known for their collaborative approach in conducting security testing.

From the initial engagement, Lista expected that Secuna’s team of skilled and seasoned penetration testers would provide high-quality and detailed reports — and they successfully delivered. In addition, being able to directly communicate with the penetration testers and discuss remediation recommendations made the process of fixing vulnerabilities on their end more seamless. This level of expertise and professionalism has not only drawn Lista back for not just one or two, but three successful collaborations in 2023 alone — and they are looking forward to teaming up again in future engagements.

Continuously Elevating Cybersecurity Standards
Lista engaged in several collaborative efforts with Secuna, initiating a comprehensive penetration testing for the entire system of their Android and iOS mobile applications during their first engagement. Subsequently, upon the introduction of new features such as Budget Buddy, OCR, and the KYC process, a targeted round of testing was conducted to assess the security of these specific modules. Lastly, Lista took a proactive stance in enhancing its security posture by extending the assessment to include the security evaluation of their AWS cloud infrastructure in their latest engagement in 2023.

The collaboration highlights the following actions:

• The penetration testing for Lista’s mobile applications was done based on frameworks like OWASP MSTG/MASVS and OWASP Top 10 API Vulnerabilities.
• Secuna’s own penetration testing methodologies along with other cloud exploitation frameworks were applied for Lista’s cloud asset.
• Detailed reports were provided in real-time in the Secuna platform, prompting immediate action on the most important items, over the course of each engagement.
• Agile and highly collaborative remediation approach was utilized through the Secuna platform.
• Secuna provided unlimited retesting for 1 month for each engagement to properly verify the effectiveness of the fixes applied by Lista on the discovered vulnerabilities.

And these actions yielded the following outcomes:

• The Secuna team, on average, submitted the first vulnerability report within 4.5 days from the start of engagement.
• The Lista team successfully fixed a total of 24 security vulnerabilities identified by the Secuna team.
• Among the identified vulnerabilities, six (6) were rated from High to Critical by the Secuna team based on the industry-standard scoring system CVSS 3.1.
• The Lista team demonstrated a commendable response time, averaging 34.5 days to remediate the first valid report submission.
• The Lista team showcased an impressive average remediation time of 34.5 days.
• During the retesting phase, only 25% of the applied fixes were reopened, highlighting Lista team’s ability to deliver immediate and effective remediation.

Making a Difference
As Secuna and Lista continue to work together, the latter has now adopted multiple security practices to enhance the protection of their assets and users’ data.

Lista indicated that they have incorporated and followed Secuna’s recommendations to boost their security — this includes readying tools for automating code scans to check for vulnerabilities and improve code quality.

Moreover, along with applying specific practices on their own, Lista also stated the importance of having the security of their products and services regularly tested by an organization that they trust, which has been Secuna for over a year and counting.

As a company that extends their commitment to cybersecurity to everyone, here’s a piece of advice Lista has for other organizations that are considering getting penetration testing services,

“Don’t compromise on cybersecurity, as even minor vulnerabilities can significantly impact your organization. Collaborate with seasoned partners like Secuna to assess the security of your products, services, and infrastructure.”

Are you ready to secure your platform? Collaborate with Secuna now!

In today's tech-filled world, the surge of cyber threats poses significant risks to individuals, organizations, and even entire nations. As our dependence on wireless networks expand, so does the playground for malicious actors, resulting in frequent date breaches, ransomware attacks, and cybercriminal activities. In this digital landscape that brings unparalleled convenience and efficiency, prioritizing cybersecurity through services like Vulnerability Assessment and Penetration Testing (VAPT) stands as a critical proactive measure to secure our digital assets and protect both our valued users and organization.

Vulnerability Assessment and Penetration Testing (VAPT): The Crucial First Step Toward Safeguarding Your Assets

VAPT stands as an essential pillar for an organization's digital security. It allows organizations to proactively identify, analyze, and fix weaknesses within their digital infrastructure before they become exploitable targets for malicious actors.

Vulnerability Assessment involves a systematic review of software, networks, and systems, usually through the use of automated scanning tools, to uncover potential weaknesses. Penetration Testing goes a step further by allowing a team of security researchers (hunters) to simulate real-world cyber attacks to identify vulnerabilities, assess the resilience of defenses, and uncover potential security gaps. These combined approaches empower individuals and organizations to reinforce their digital defenses, stay ahead of evolving threats, and guarantee the confidentiality, integrity, and availability of sensitive information. In a time where cyber vulnerabilities wield unprecedented impact and consequences, VAPT becomes a crucial first step towards safeguarding an organization's assets and developing a more secured digital environment for everyone.

What Weakens Your Defense From Digital Threats?

Various factors contribute to the vulnerability of digital platforms. These vulnerabilities can range from flaws in software and hardware design to human errors and malicious intent. Unraveling these causes is vital in crafting  an effective and robust cybersecurity strategies to safeguard your digital assets and preserve the integrity of the interconnected world we navigate today. Let's explore some of the multifaceted origins of vulnerabilities, according to a report released by National Security Agency (NSA) way back in 2020, and shed light on the intricacies of the challenges faced in the field of digital security:

• Poorly configured system
• Poor access control management
• Shared tenancy between multiple software and hardware systems
• Vulnerabilities introduced by supply chains

Why is VAPT Important?

VAPT, as a proactive and strategic methodology, plays a pivotal role in identifying, evaluating, and mitigating potential security risks in our systems. Understanding the importance of VAPT involves recognizing the dynamic nature of cyber threats and the potential vulnerabilities that lurk within digital assets.

Let’s delve into the significance of VAPT and highlight why this proactive approach to cybersecurity is crucial in identifying and addressing vulnerabilities before they can be exploited by malicious actors:

• To identify security gaps in your organization's systems
• To strategically prioritize the mitigation of discovered risks
• To improve your product Software Development Life Cycle (SDLC) process

Secuna Pentest: Your Modern Approach to VAPT

Secuna Pentest is a proactive approach that simulates real-world attacks in order to conduct thorough manual assessments of digital assets. Combined with the utilization of the Secuna Platform, vulnerabilities are reported instantly to organizations, enabling prompt triaging and prioritization of the mitigation of critical risks. Our service aims to empower organizations to seamlessly integrate cybersecurity testing to their software development life cycle to elevate their defenses, proactively mitigate potential risks, and enhance the overall strength of their cybersecurity early on during the development to defend against evolving threats before they become an even more expensive problem.

Diversified Secuna Penetration Tests

• Web App Pentesting
  We provide an efficient manual and automated exploitation of your custom-developed or CMS web applications.
• Mobile App Pentesting
  We exploit vulnerabilities in both iOS and Android mobile applications, providing valuable insights into the potential risks that your applications may encounter.
• Network Pentesting
  We conduct thorough security assessments of both external and internal network infrastructures to identify and mitigate potential vulnerabilities that could put your servers at risk.
• Cloud Pentesting (AWS)
  Our Cloud Penetration Testing (AWS) service provides an intensive assessment of your cloud infrastructure’s to discover potential misconfigurations and other potential lapses in your security defense.
• API Pentesting
  Safeguard your digital assets and protect your organization’s data with our API Penetration Testing service, exclusively focused on GraphQL and REST APIs.

Benefits of Secuna Pentest

• Satisfy Security Compliances: Ensure adherence to compliance and regulatory requirements, including but not limited to PCI-DSS, HIPAA, ISO 27001, SOC 2 Type II, DPA of 2012, GDPR, and CCPA through the strong security measures provided by Secuna Pentest.
• Highly Experienced Hunters: Our certified hunters with certifications like OSCP, OSWE, CEH, CySA+, CISSP, CompTIA (Network+ and Security+), CCS-SCOR, and more  undergo a rigorous screening process, ensuring that you collaborate with the best experts in the security field, guaranteeing the highest standards of excellence, credibility, and trustworthiness.
• Extensive Vulnerability Identification: Mitigate and minimize risks within your digital assets through our efficient and comprehensive testing. We proactively identify and address weaknesses and vulnerabilities in your application, preventing potential exploitation by malicious attackers.
• Elevated Security Posture: Strengthens your overall security posture and reduces the likelihood of successful cyber attacks. Secuna Pentest ensures that potential weak points are protected, contributing to a more secure and resilient digital environment.

As we navigate through the ever-evolving digital landscape, the importance of protecting our digital assets, to protect both our organizations and valued users, cannot be overstated. VAPT serves as the first step in developing a proactive security measure, offering crucial insights into potential security risks and vulnerabilities. Secuna Pentest, with its diversified and modern approach in conducting penetration testing as well as its commitment to compliancestandards, stands as a beacon of cybersecurity commitment. Secuna’s highly experienced hunters and comprehensive vulnerability identification contribute to an elevated security posture, reducing the likelihood of successful cyber-attacks. In embracing Secuna Pentest, together, we strengthen our defenses, mitigate risks, and collectively shape a more secure and resilient digital future.

Don’t have second thoughts on protecting your assets.
Collaborate with us now!

Every organization, though sharing an industry, carries its own unique identity shaped by its vision, mission, and core values. This individuality is further defined by industry nuances and distinct assets that they use to run their organizations or businesses.

Secuna, powered by its community-powered platform, extends its commitment beyond securing your business. We value your distinctiveness and prioritize your specific security needs.

This is embodied in one of our products, Secuna Response (Vulnerability Disclosure Program), a security program designed to cater to your organization’s unique objectives. Here, you wield the power to customize your security program to employ the expertise of our experienced hunters in our community in securing your assets while keeping everything aligned precisely with your organization’s security requisites.

What is SECUNA RESPONSE?

Secuna Response stands as a steadfast security initiative, showcasing your unwavering commitment to cybersecurity. This program engages a community of trusted cybersecurity professionals (hunters) who responsibly report vulnerabilities in your digital assets. This welcomes a “See Something, Say Something” process that helps ensure that potential security vulnerability reports end up with your team for you to properly and swiftly respond to before threat actors exploit them.

To know more about how Secuna Response works, read here.

Fine-Tune Your Secuna Response Program to Perfection

Starting your own Secuna Response program is just a few clicks away. Simply select the plan (Basic, Standard, Enterprise) that aligns with your organizational needs and proceed with the payment for the chosen subscription. Our Basic plan is complimentary, yet requires the submission of supporting documents for verification and approval before you can st2art setting up your program.

Once you are all set, you will be guided to customize your program according to your specific requirements. Here are the essential steps to tailor your program:

1. Program Information: Provide essential details to present your security program in the best light.

• Program Name
  Create an engaging and memorable program name that intrigues hunters, encouraging them to explore your program further. Consider using your organization’s brand or product name for a simple yet effective choice.
• Program Description
  Provide a concise description of your organization’s brand or product, providing insight into what your platform offers. Capture the hunters’ passion to help by effectively communicating your vision with them.
• Program Visibility
  Select the program visibility that aligns with your organization’s comfort level to determine who can view and participate in your program, ensuring a suitable fit for your security measures.
  
  Public Visibility - everyone can view non-sensitive information of your program but only registered and logged in hunters can participate in your program.
  
  Protected Visibility - all registered and logged in hunters can view non-sensitive information of your program but only verified hunters can participate in your program.
  
  Private Visibility - only invited verified hunters can view and participate in your program.

Here is a good example of what you can put in your program information:

• Program Name: Secuna
• Program Description: Secuna is a community-powered SaaS platform that helps protect organizations by allowing researchers to submit quality vulnerability reports.
• Program Visibility: Protected

2. Program Policy: Craft a distinct disclosure policy, outlining guidelines for participating hunters.

Here is a template that follows industry-standard ISO/IEC 29147 and disclose.io that you can use as reference.

3. Assets: Define in-scope (the list of assets you want our hunters to test) and out-of-scope (list of assets that’s not included in the program scope) assets to guide hunters in their testing efforts, with limits based on your subscribed plan.

Here you will provide the type of asset/s (e.g. Custom Web App, iOS Mobile App, Cloud, etc.) you want our hunters to test, their description, and their identifiers (URL, App ID, IP Address).

4. Program Members: Add key team members from your organization to oversee program management, with limited seats based on your subscribed plan.

To add a team member from your organization to the program, simply choose a role and supply their email address.

5. Hunter Invitation (For Private Programs): Handpick specific hunters for exclusive participation through personalized invitations.

To help you choose the most suitable hunters for your program, you can view their profile to see their ranking, skills, certifications, total points, resolved reports, thanks received, and total bounties received.

6. Schedule: Plan the launch of your program strategically by scheduling its start date effectively. Opt for an immediate launch post-setup or set a specific date for a scheduled launch in the future.

7. Launch: Complete the program setup process and wait for your program to launch!

Once your program becomes active, you'll seamlessly transition to your program dashboard, providing a comprehensive overview of your program. Now, all you have to do is to wait for reports from our hunters to come in, and promptly address any identified issues. Additionally, the platform provides the option for you to pause the program while maintaining your subscription, allowing you to temporarily halt the submission of new reports as you address the other existing reports first. You can resume your program at any time right after.

Secuna Response values more than just your security initiative, it extends to the principles of your organization and what it upholds. With Secuna Response’s customization functionality, from choosing plans to crafting program details before activation, you now have more capability in fortifying your digital assets according to your business objectives while ensuring a safer cyber-environment.

Are you excited to align your objectives with our program? Connect with us now!

In today's interconnected world, the continuously evolving technology offers us convenience in our daily lives but it is significant to acknowledge that it also presents us with various threats in the cyberspace.

This year, the Philippines witnessed a string of breaches across  notable government agencies like PhilHealth, the Philippine Statistics Authority, and law enforcement institutions such as the Philippine National Police. Private institutions like De La Salle University also had their own fair share of security incidents.

Amidst this evolving virtual landscape and growing cyberthreats, Secuna emerges with solutions such as Secuna Response (Vulnerability Disclosure Program), designed to boost your confidence and reinforce your security measures.

What is SECUNA RESPONSE?

Secuna Response is a continuous security program that will show your constant commitment to cybersecurity by allowing a community of trusted cybersecurity professionals (hunters) to properly and responsibly report security vulnerabilities concerning your digital assets that can be addressed before threat actors exploit them.

How does SECUNA RESPONSE work?

Secuna Response stands as a powerful initiative to boost your organization's security initiatives. It is essential to have a deeper understanding  on how it works to ensure that you can tailor your security program to seamlessly align it with your organization's business goals and specific requirements.

Here is a quick guide to help you get up and running with your first Secuna Response program:

Step 1: PROGRAM POLICY TAILORING and LAUNCHING
Our platform will allow you to create a customized security program policy tailored to your organization's unique requirements before launching the program. This step enables you to set the necessary rules and guidelines for the hunters to follow as they conduct tests in your organization's assets.

For a deeper understanding of policy tailoring, read the Secuna Response Program Customization here.

Step 2: NOTIFYING HUNTERS and VULNERABILITY HUNTING
Once you launch your program on the Secuna Platform, our hunters will be notified and swing into action. They will meticulously gather information about your application and carefully map its external footprint to pinpoint potential source of breaches during testing.

Step 3: MANAGING REPORTS
After discovering vulnerabilities, hunters will submit a comprehensive report of their findings through your Secuna Response program that will be reviewed, validated, and addressed by your internal team.

As a token of gratitude for their invaluable contributions to your Secuna Response program, our hunters receive the following acknowledgement from your organization:

• Thanks - this recognition is granted for each program once a report submitted by a hunter has been successfully resolved, enabling them to track the number of programs they made impactful contributions on the Secuna Platform.
• Reputation Points - hunters receive points or demerits to their reputation depending on the status of their reports. These points reflect the quality of their reports and their collaborative efforts with programs, shaping their standing in the Secuna community.

Why do you need SECUNA RESPONSE?

A great way of showing the world your devotion to building a safer cyberspace for everyone is through Secuna Response. These are what’s in the bag for you, along with real-life practice of placing high significance to cybersecurity:

Ready to experience Secuna Response first-hand? Collaborate with us now!

Dragonpay is the pioneer in alternative online payments in the Philippines giving access to customers to purchase goods or services online and pay for them using cash at physical, brick-and-mortar payment counters, ATMs, mobile wallets, or through online bank debit. Today, Dragonpay has processed over 100 million online transactions for Filipinos globally.

Since its founding in 2010, Dragonpay’s mission is to provide a more secure yet easily available e-commerce payment channel for the broad market.

Currently, they want to:

• maintain their commitment to have a secure solution
• get tested and certified by DICT-recognized cybersecurity assessment company
• identify if they are vulnerable to cyber attacks and exploits

After searching around for a penetration testing service provider, Dragonpay reached out to Secuna after a friend recommended its services. They talked to other local and foreign vendors but they decided to move forward with Secuna because of its reputation in the startup community and its recognition from DICT.

Secuna, a DICT-recognized cybersecurity assessment provider, helps ensure that any organization has their assets protected from potential cybersecurity issues and data breaches with service rates that are very equitable.

Secuna provided a Web Application Penetration Testing service to thoroughly assess the security of Dragonpay’s website application.

After a month of thorough penetration testing, 17 unique security vulnerabilities were reported, validated, and resolved. Three of which were found that had a severity score of higher than 7.0 in reference to Common Vulnerability Scoring System (CVSS).

Dragonpay team is very happy with the results and they would engage with Secuna again for future cybersecurity needs.

"We're very happy with the results. The service was very friendly and helpful."
– Robertson “Dick” Chiang, Founder and COO/CTO of Dragonpay Corporation

To learn more about DragonPay, visit their website https://www.dragonpay.ph/

Ready to secure your platform? Get in touch with one of our cybersecurity experts today.