Blog

By Steve Gold, Posted in Security

In the Fallout series on Prime Video, nothing in the wasteland is random. Every mutant, every ruined city, every ideological conflict traces back to decisions made by Vault-Tec executives and government officials decades before the bombs fell. The show is not really about survival. It is an archaeology of consequence, and a long, unbroken chain connecting a bad decision to a catastrophic outcome. Root cause analysis in software security works the same way. A vulnerability is never just a vulnerability. It i... read more.

• November 03, 2026

By Eric Corcoran, Posted in Technology Week in Review

Monday 10/26 CTO Tech Talk: Rethinking Software Supply Chain Security On October 22, 2026, Gotham's CTO, Ken Phelan, was joined by ReversingLabs' Vice President, Product Management, Erik Thoen, to discuss how the Software Bill of Materials (SBOM) you received might not be telling you the full story and how AI is rapidly changing software supply chain attacks. Click the link below for the full video: https://www.youtube.com/watch?v=B3PoBMbZ9Mg Tuesday 10/27 CIS Safeguard 16.2: Establish and Maintain a... read more.

• October 30, 2026

By Ken Phelan, Posted in Security

If you're like me, you've read The Art of War. Or at least you've sat through a keynote where someone put it on a slide. I'm a book geek, so I've done both. Sun Tzu has been applied to sales, chess, football, and probably your last reorg. Here's the thing. Most of it reads like common sense. Know your enemy. Know yourself. Don't pick fights you can't win. Thanks, coach. I recently came across some analysis that changed how I read it. When it was written, that kind of common sense was anything but common. ... read more.

• October 28, 2026

By Steve Gold, Posted in Security

Watch one episode of The Bear and you will notice something. The best kitchens do not just run on skill. They run on a culture where anyone can call out a problem, and that problem gets addressed instead of buried. Chef Carmen Berzatto does not want a kitchen where bad news hides. He wants a kitchen where bad news gets surfaced fast, because surfacing it is how you fix it. If your organization has no structured way to receive and act on software vulnerability reports, you are running the equivalent of a ki... read more.

• October 27, 2026

By Eric Corcoran, Posted in Technology Week in Review

Monday 10/19 Inside the Q3 2026 Brand Phishing Report: Microsoft Now Accounts for One in Three Brand Impersonation (Check Point) In Q3 2026, Microsoft was the most impersonated brand in phishing attacks, accounting for 33% of all brand impersonation attempts tracked by Check Point Research, up from 23% in Q2. Attackers favor Microsoft because stolen Microsoft credentials can unlock an entire corporate environment. https://blog.checkpoint.com/security/inside-the-q3-2026-brand-phishing-report-microsoft-now... read more.

• October 23, 2026

By Steve Gold, Posted in Security

Watch Andor on Disney+ and pay close attention to how Luthen Rael runs the Rebellion. He does not wing it. Every cell has defined procedures, defined limits, and defined checks. Security is not something he layers on after the operation is planned. It is built into how every mission runs from the first conversation. Your software development process should work exactly the same way. What Is Establish and Maintain a Secure Application Development Process? It means security is part of how you build software... read more.

• October 20, 2026

By Eric Corcoran, Posted in Technology Week in Review

Monday 10/12 Solving the Continuous Authorization Conundrum (CrowdStrike) Organizations have realized they must move from a “walled garden” security model, in which all computers inside a firewall or accessing via VPN are assumed to be trusted, to a Zero Trust model in which every access is independently evaluated. https://www.crowdstrike.com/en-us/blog/solving-the-continuous-authorization-conundrum/ Gotham Managed Vulnerability & Prioritization Managed Service With new vulnerabilities... read more.

• October 16, 2026

By Ed Bratter, Posted in Infrastructure, Security, Support

You wake up one morning, grab your coffee, and sign in to Microsoft Outlook (or any other app secured by Microsoft Entra ID). You enter your username and password, approve the usual MFA prompt, and expect to see your inbox. Instead, you get an unfamiliar screen: "Let's keep your account secure." If you're seeing this, keep reading to learn what's going on and what to do about it. For many organizations, this prompt started appearing in September 2026. It's the first phase of Microsoft's plan to retire S... read more.

• October 15, 2026

By Ken Phelan, Posted in Security

I've been reading about drones. I recommend it, in the way I'd recommend a horror movie. Here's the short version. In Ukraine right now, drones cause 70 to 80 percent of all battlefield casualties. Not artillery. Not tanks. Quadcopters. Russia claims production rates approaching seven million of them a year. Ukraine builds four million. The drone that's winning the war costs roughly a thousand dollars and kills a five-million-dollar tank. The most advanced militaries on earth spent eighty years and trillio... read more.

• October 14, 2026

By Bert Amodol, Posted in Security

What two real incidents taught us about keeping pace with an AI-speed adversary. Three weeks ago, I wrote that your SOC isn't slow; the fight has simply gotten faster. I ended with a question: what was the first thing your team changed when AI appeared on the other side of that fight? I didn't expect my own colleagues to prove the point just days later, and in public. Within days of that post, Gotham engineers were responding to live incidents. Brian Wagner spent a week investigating the NetScaler® a... read more.

• October 13, 2026