Overview
Curios is a team of senior security consultants offering enterprise-grade cybersecurity services including penetration testing, cloud security assessments, compliance certification, vCISO services, and security awareness programs. The firm operates with 8+ years of enterprise protection experience, 48 advanced certifications across its team, and 130+ combined years of experience, serving clients across manufacturing, finance, and automotive sectors.
Key people
In the news
- Mateusz Gierblinski is credited on two CVEs published one day apart. CVE-2026-70007 in the .NET Framework. CVE-2026-93479 in NGINX, the software in front of a large share of the world’s websites. Including, most likely, some of yours. The NGINX flaw is simple to trigger. One plain web request, stuffed with a long string of the letter A, knocks the server offline. Under certain conditions it runs code on it. No login needed. Severity 9.2 out of 10. He found it in code that had already been patched in July. Fixed now, in 1.30.6 and
- Someone in finance opens a file in one of your internal Windows applications. The file looks fine. Behind it, code runs with their permissions. Their mailbox, their shared drives, their payment system. That is what CVE-2026-70007 made possible until Microsoft closed it on 13 October. The flaw sat in the .NET Framework, which ships inside Windows and runs under most of the internal tools a Belgian organisation uses every day. Severity 8.8 out of 10. No password needed. Just one opened file. The researcher credited with
- Curios has been selected for CYSSDE, the EU program that funds penetration testing across Europe. The idea behind CYSSDE is simple. NIS2 now expects essential and important entities to prove they are resilient. Many of them, and the SMEs that supply them, have never had a real attacker look at their systems. So the European Commission, through the Digital Europe Program, selects the firms allowed to deliver penetration tests. 🔍Selection is on capability, not size. The committee looks at offensive expertise, proven methodology and
- Is a pentest mandatory under NIS2?" The good news: you do not need six tests. One test, scoped on your critical systems and mapped to each framework, can feed several at once. check out: https://lnkd.in/ejx3VdhY #PenetrationTesting #NIS2#compliance
- TIBER is a method the ECB wrote for banks in 2018. Its best ideas cost nothing to borrow. Banks get it imposed under DORA. Other suppliers will never be asked. That is fine. The method was never the expensive part. The supervision was. Five things a TIBER test does that a standard pentest usually skips. All five fit a NIS2 budget. - It starts with a threat picture. Named actors, their tooling, the route they would take into your organisation. The scope follows from that, not from an asset list. - It runs on production, with a small
- Ondertussen acht jaar werkt het Curios team van senior security consultants aan de veiligheid van verschillende industrieleiders. En 2027 wordt het jaar waarin we een versnelling hoger schakelen. Dus bouwen we het team uit met drie profielen, in vaste dienst: Sales. Iemand die security begrijpt, het gesprek met een CISO durft aan te gaan en samen met mij de volgende klanten binnenhaalt. Security engineers. Mensen die infrastructuur en identity niet alleen kunnen uitleggen, maar ook beveiligen bij de klant. Offensieve specialisten.
- Before you sign the next penetration test, check who the scope was written for. If it was written to satisfy an audit, it will pass an audit. Whether someone can get in is a separate question. The scope document is where that gets decided. Worth reading what the rules ask. NIS2 Article 21 asks you to assess whether your controls work, not to produce a certificate. DORA has been live since 17 January 2025, and significant entities run threat-led testing under TIBER-EU every three years. Three years. Your estate does not stand
- One of this week's 394 Microsoft fixes mentions us. CVE-2026-70324, elevation of privilege in SharePoint. The acknowledgement reads "Mateusz Gierblinski with Curios". One bug out of 394. We will not pretend it changes the world. But it is the kind we spend our days on. Not how attackers get in: how a small foothold becomes the whole tenant. A scan tells you which patch is missing. We test what someone could do. Penetration test, assessment, retest. https://lnkd.in/ejx3VdhY If you run SharePoint Server: patch it and if you
Something wrong or missing? Send an update. Fixed within 24 hours.