Approach Cyber

02/09/2026

Cybersecurity bij steden, gemeenten en openbare besturen: hoe voorbereid is jouw organisatie op de uitdagingen van morgen? 💁

Op 1 oktober is Approach Cyber aanwezig op de CIS Dag van V-ICT-OR in Mechelen. We verwelkomen je graag bij onze stand voor een vrijblijvend gesprek over wat wij dagelijks zien in jullie werkveld of gewoon voor een korte babbel!

📅 Datum: Donderdag 1 oktober 2026
⏰ Tijd: 09:00 – 17:00
📍 Locatie: Lamot Congres- en Erfgoedcentrum, Mechelen
👥 Voor wie: IT-verantwoordelijken, CISO's, algemeen directeurs en bestuursleden van lokale overheden

Zien wij jou in Mechelen op 1 oktober? 👉https://loom.ly/QMJTmtw

25/08/2026

Eight weeks. One message: the threat doesn't pause because you do.

September brings its own risks; full inboxes, deferred decisions, distracted teams. The window doesn't close; it shifts.

🗣️ 💬 If this series raised a question you haven't answered yet, now is a good time.

Specific need, no idea where to start, or just want a conversation? We're here. No pitch, no pressure.
👉 https://loom.ly/spXcqM4

18/08/2026

Our pentesters got in. Again. 🚨🥷

5th edition of the Approach Cyber Pentest Annual Report is out. The findings across Belgian organisations are consistent: misconfigurations, weak credentials, unpatched systems, overprivileged accounts.

Not exotic. Not new. Just unaddressed.

If you're building a security roadmap or presenting risk to a board 👉 this is your benchmark.
📥 https://loom.ly/bOvVeRU

11/08/2026

Threat modelling is no longer optional.
NIS2 and the CRA have made risk assessment in software development a legal requirement;
✅ Documentation
✅ Risk registers
✅ Evidence of security decisions at design stage
✅ A repeatable methodology.

Most development teams have gaps they don't know about.

👇 Our publication maps exactly what's required and where teams typically fall short 👇
https://loom.ly/aBZw2o0

04/08/2026

Does the EU Cyber Resilience Act apply to your product?
If your answer is 'probably not' 👉 check again

The CRA scope is wider than most companies assume;
🔸 connected devices
🔸 software with digital elements
🔸 commercial tools

⚠️The obligations are real: secure by design, vulnerability handling, incident reporting.

Not knowing isn't a defence.
ℹ️ https://loom.ly/TcDPgZY

28/07/2026

The NIS2 deadline passed in April. Now what?

Compliance isn't a project you finish. It's a posture you maintain;
✔️ continuous risk management
✔️ regular reporting
✔️ sustained technical measures

Organisations that treated it as a one-time checklist are already behind...

Our latest piece breaks down what long-term NIS2 compliance actually looks like in Belgium 🇧🇪
👉 https://loom.ly/_NRSSqw

21/07/2026

We put a server on the internet. Then we waited ⏳

⏰ Within hours: automated scanners.
📅 Within a day: active exploitation attempts.
👀 By the end: the server had been weaponised, without any attacker knowing it was a trap.

This is what happens to forgotten, misconfigured, or unpatched services right now.

We documented the full timeline. If you manage infrastructure, read this 👉 https://loom.ly/b5tZaVA

17/07/2026

War Story 03: Tokens in the open, Keys to the Kingdom 🔑
Your software development pipelines and internal chat channels might be the biggest hidden entry points into your production environment...

In our Pentest Annual Report 2026, we explore how easily these platforms turn into high-risk vectors:

☝️ CI/CD pipelines are the new perimeter: A single poisoned build step often runs with more implicit trust than production accounts, turning one bad pull request into a major supply-chain breach.

✌️ Collaboration tools are credential graveyards: From active tokens to passwords, vital secrets are routinely left sitting in daily chat threads, giving attackers a perfect treasure map.

Are your internal systems unthinkingly trusting these hidden perimeters? Stop guessing and start benchmarking your team's development practices against real-world attack paths.

📥 Download the full report here for free, to discover all 4 major trends and 952 findings: https://loom.ly/bOvVeRU

Our 2026 Pentest Report offers an unfiltered look into our Success Stories, Latest Trends and Key Statistics of the past year.

14/07/2026

Your firewall didn't cause that breach. Your employee did 🙋‍♂️

Attackers have moved from systems to people, because people are easier to manipulate;
🥷 Phishing
🥷 Pretexting
🥷 Vishing
🥷 ...
The target stays the same.

The flip side: a well-prepared employee is harder to fool than any automated system.

We held a webinar on how to build that. Worth checking out before your team goes on holiday 🏖️👇https://loom.ly/9Q_vxmQ

10/07/2026

"War Story 02: The Ghost in the Machine Account" 👻👇
An identity assigned to a computer, not a person, completely owned the entire domain.

During a recent Red Team engagement, our ethical hackers discovered a stale, non-human machine account (MACHINE-01$) that nobody had reviewed for years.

The real shock? 👀
It was a full member of the Domain Admins group.

In our Pentest Annual Report 2026, we break down the exact attack cascade:
☝️ Legacy Service Compromise
✌️ Cleartext Credentials
🤟 Inherited Dominance

The critical takeaway for CISOs?💡
Audit your non-human accounts the way you audit humans. Stop guessing and start checking your environment for hidden privileges.

📥 Download the full report here for free, to discover all 4 major trends and 952 findings: https://loom.ly/bOvVeRU