What’s under attack right now, straight from the sources.
A program pulls the advisories from CISA and ENISA and puts them on the alerts page, each with its timestamp and a link. Nothing is entered by hand.
What’s happening now
The latest flaws under attack in software many businesses use. Everything else, outages and updates included, is on the alerts page.
The current list is on the alerts page.
How do you spot fraud in my name?
I never ask you for a password, a code or access by email or over the phone. If that happens in my name, it wasn’t me.
- How to tell
-
- It’s urgent, and nobody else is supposed to know.
- The channel is new: a different number, a different address, a link instead of the page you know.
- In the end, it’s about a password, a code, access or a bank transfer.
- A call in my voice
- Voices can be copied with AI now, mine too. Hang up and call back on the number you already have from me, never the one from the call. The same helps in your business, when the boss supposedly calls and needs a transfer fast.
- When in doubt, check
- Write to .
How do you know it’s really me?
-
First contact
Whether I call or you write first: email from me comes from an address on sw-labs.de, unless we’ve agreed otherwise.
-
The first call
On the phone or by video. It’s about your workflow, never about access.
-
When we sign
Your business gets its own area in my password manager, with you as a member. From then on, we share access only through it.
-
The code word
We agree on it right after, on the phone or in person, never in writing. It’s stored in your area of the password manager. If a call is about access or money, ask for it, and I’ll ask you too.
How does the list get onto the alerts page?
I read the advisories every day myself. They get onto the alerts page without me.
-
Fetch
Every 15 minutes, a program pulls the sources: CISA, ENISA, AWS and the providers’ status pages.
-
Sort
It groups advisories by product and puts vendors many businesses use first. Which software I use myself plays no part in that.
-
Show the timestamp
Every list carries its timestamp, and an old one never looks fresh. Vulnerabilities, for example, count as old after four days; after ten, only the links to the sources remain.
-
If it fails
Then the links on the alerts page go straight to the sources.
This list is a taste of bearing, my tool for sorting out what’s worth your time. There, you’ll also be able to put together the security advisories that match your software.
What does this have to do with my workflow?
A workflow connects programs. Every connection needs access, and someone has to guard every bit of access.
If a program from your workflow shows up in the list above, that’s exactly the kind of access at stake.
What happens to the access you give me?
In the password manager, in your business’s area. A key never sits in the code.
- Only what the workflow needs
- Each workflow gets only the permissions it needs. I switch off the rest.
- Before it goes online
- I look at it from the outside: what a stranger can see and which access is open.
What if a program in my workflow is under attack?
Then we both find out: you in your account and by email.
I prepare small fixes. What goes in without downtime, I apply; anything that could stop your business even briefly waits for your approval.
What may AI do in my workflow?
Never everything at once.
An AI workflow that reads your email must not also send email out on its own. I build that separation into every workflow.
What if something happens on your end?
Then you hear it from me as soon as I know, with what I know and what’s still open.
- Your deadline
- If personal data is affected, you usually have 72 hours to notify the data protection authority (Art. 33 GDPR).
Does the Digitalbonus cover security too?
Yes. Bavaria’s Digitalbonus has its own area for it, IT security.
- What it covers
- Introducing or improving IT security in your business, plus the hardware it needs, such as a firewall or backups.
- What I build for it
- The security of the workflows I build and keep running for you, as described on this page. Computers, network and firewall are set up by whoever looks after your IT. Together, that can become one project.
- Application first
- Work can only start once your application has been confirmed as received. Small commercial businesses with a site in Bavaria can apply; liberal professions can’t.
- Who decides
- Your district government, with no legal entitlement. It can be funded; I can’t promise it.
How can I check this?
- This page’s headers
- This page tells every browser what it may load. Check it yourself, for example in the Mozilla Observatory. Open the Mozilla Observatory
- Found a vulnerability?
- Write to ; the address is also in security.txt.
Questions about security
- Do you check the security of all my IT?
- No
- If I notice something about your software while building, I’ll tell you. Everything else stays with whoever looks after your IT. How that works with your IT provider
- Is SW labs certified, for example to ISO 27001?
- No
- For the workflows I build for you, you get the documents in writing: the data processing agreement with its technical and organizational measures, the list of services I use for it, and the reporting path.
- A large customer wants proof of my IT security, for example because of NIS2. Can you help?
- Yes
- With those documents, for the workflows I build. For the rest of your business, you or whoever looks after your IT answers.
- Do you check whether NIS2 applies to my business?
- No
- The BSI answers that. Go to the BSI check (in German)
- Do you install updates on my systems?
- Partly
- For everything I build and keep running: me, and anything that could stop your business waits for your approval. For your computers and software: whoever looks after your IT.
- Is the list above complete?
- No
- It’s a selection from public sources, highlighted by vendors many businesses use, not by your software.
A workflow you still do by hand?
Tell me which one. I’ll also tell you what access it would need and who guards it.