Peakhour.IO - Application Security

When Home Devices Become Attack Infrastructure

AC — Sat, 01 Aug 2026 12:30:00 +1000

Application teams cannot clean compromised televisions, routers, or household devices. They can stop treating the residential address as proof and control what the relayed request is allowed to do.

How to Tune F5 BIG-IP Advanced WAF

AC — Wed, 29 Jul 2026 10:15:00 +1000

Run F5 BIG-IP Advanced WAF in Transparent mode, review staged matches and learning suggestions, and limit each exception to the URL, parameter, cookie or content profile that needs it.

How to Tune Google Cloud Armor WAF Rules

AC — Wed, 29 Jul 2026 10:00:00 +1000

Tune Cloud Armor preconfigured WAF rules with preview traffic, versioned signatures, sensitivity levels, field exclusions and policy priority.

How to Tune Cloudflare WAF When Rule 949110 Blocks a Request

AC — Wed, 29 Jul 2026 09:45:00 +1000

Trace a Cloudflare OWASP anomaly-score block to the rules that raised the score, then choose the right override or exception.

How to Tune Azure Application Gateway WAF

AC — Wed, 29 Jul 2026 09:30:00 +1000

Start Azure Application Gateway WAF in Detection mode, find false positives in Log Analytics, narrow each exclusion and move into Prevention mode.

How to Tune AWS WAF with Count, Labels and Rule Priority

AC — Wed, 29 Jul 2026 09:15:00 +1000

Use Count overrides, managed-rule labels and rule priority to fix AWS WAF false positives while keeping the rest of the managed rule group in force.

How to Tune Coraza on Caddy

AC — Wed, 29 Jul 2026 09:00:00 +1000

Run Coraza and OWASP CRS on Caddy in DetectionOnly, read the audit log and limit each exclusion to the field and route that need it.

How to Tune Your WAF Without Turning It Off

AC — Tue, 28 Jul 2026 10:30:00 +1000

A practical process for running a CRS-based or managed WAF in detection mode, finding repeatable false positives and writing narrow exceptions that survive real application traffic.

When and Why to Use a WAF: A Guide for WAF Sceptics

AC — Tue, 28 Jul 2026 10:00:00 +1000

WAFs are neither useless nor a security force field. Here is what they are good at, where they fail, and when putting one in front of an application makes sense.

Your Application Needs a WAF. Just Not for the Reason You Think

AC — Tue, 28 Jul 2026 09:30:00 +1000

A web application firewall will not fix insecure code. It can still give applications a valuable layer of protection when bugs, bots and attacks reach the front door.

Everyone Says a WAF Is Useless. Are They Right?

AC — Tue, 28 Jul 2026 09:00:00 +1000

Ten good reasons not to trust a web application firewall—and why most of them are arguments for using one properly, not going without one.

Protecting Against a Share Point Zero Day Vulnerability with Network Fingerprinting

Dan — Wed, 23 Jul 2025 13:00:00 +1000

Analysis of attempts to exploit a recent Share Point zero day vulnerability reveal network fingerprinting and classification is a robust defense.

How AI Agents Are Writing Custom Exploits

AC — Mon, 17 Feb 2025 14:00:00 +1100

AI agents with reasoning capabilities like DeepSeek are revolutionizing exploit development, marking the end of traditional security approaches based on static rules and patterns.

Data-Driven Risk Management

AC — Fri, 07 Feb 2025 00:00:00 +1100

How Peakhour's contextual security aligns with Visa's data-driven risk management approach in the 2025-2028 Security Roadmap.

Visa's Security Roadmap 2025-2028

AC — Tue, 21 Jan 2025 00:00:00 +1100

An analysis of Visa's Security Roadmap 2025-2028 and how Peakhour's solutions help Australian businesses meet these security objectives.

Anti-Detect Browsers

AC — Wed, 15 Jan 2025 10:00:00 +1100

Anti-detect browsers represent one of the most sophisticated threats facing modern web applications and APIs. Learn how these tools work, why they pose a significant threat to application security, and how modern security platforms can detect and mitigate their use.

Next-Generation Application Security Defence Strategies

AC — Fri, 15 Nov 2024 14:00:00 +1100

Comprehensive analysis of AI-powered cyber threats and how modern application security platforms defend against machine learning-driven attacks. Learn advanced defence strategies for the AI cybersecurity arms race.

Managing Bots For Application Security

AC — Sun, 15 Sep 2024 00:00:00 +1000

Comprehensive guide to enterprise bot management for modern application security platforms. Learn how to protect applications and APIs from sophisticated bot threats including anti-detect browsers, credential stuffing, and automated attacks targeting DevOps environments.

Application Security for Financial Services Under CPS 234

Dan — Mon, 29 Jul 2024 10:00:00 +1000

Comprehensive analysis of credential stuffing threats against Australian financial institutions and how application security platforms help meet CPS 234 disclosure requirements whilst preventing account takeover attacks.

Account Protection and User Experience in Web Applications

AC — Wed, 17 Jul 2024 10:00:00 +1000

Explore strategies to enhance web application security without compromising user experience, focusing on contextual security and adaptive authentication measures.

Addressing Key Cloud Security Categories

AC — Wed, 01 May 2024 10:00:00 +1000

An analysis of Peakhour's role in addressing key cloud security categories identified in recent industry analysis, demonstrating its comprehensive approach to modern cloud security challenges.

Managing Breached Credential Usage

AC — Fri, 15 Mar 2024 00:00:00 +1100

How breached credential checks and risk signals help detect credential stuffing without adding unnecessary login friction.

HTTP Security Headers

AC — Tue, 28 Nov 2023 14:00:00 +1100

Comprehensive guide to HTTP security headers for protecting web applications from client-side attacks. Learn essential browser security configurations for modern application security platforms and DevSecOps workflows.

Dive into CVSS Scores

AC — Fri, 10 Nov 2023 00:00:00 +1100

Understand CVSS by examining the Atlassian CVE-2023-22515 and CVE-2023-22518.

A Risk Based Approach To Vulnerability Scoring

AC — Fri, 10 Nov 2023 00:00:00 +1100

An in-depth exploration of EPSS, its data-driven approach to assessing cybersecurity threats, and how it complements CVSS.

ModSecurity’s End-of-Life

AC — Mon, 16 Oct 2023 13:00:00 +1100

ModSecurity's end-of-life marks a pivotal moment in application security evolution. Discover how modern Application Security Platforms are advancing beyond traditional WAF approaches to provide comprehensive protection for web applications and APIs at the edge.

APRA Cybersecurity Guidelines

Dan — Thu, 12 Oct 2023 12:31:00 +1100

Comprehensive guide to APRA cybersecurity requirements for Australian financial institutions. Learn how application security platforms help meet CPS 234 compliance and Information Security Manual guidelines for protecting financial services infrastructure.

The Rise of OpenBullet

AC — Fri, 01 Sep 2023 14:00:00 +1000

How OpenBullet packages browser and HTTP automation for credential attacks, and which signals defenders can use without treating any one fingerprint as proof.

Headless Commerce Security

Dan — Wed, 28 Jun 2023 00:00:00 +1000

Comprehensive analysis of security challenges in headless commerce and Single Page Applications. Learn how to protect modern e-commerce APIs and microservices architectures from scraping, fraud, and automated attacks.

Enterprise DDoS Protection

AC — Mon, 19 Jun 2023 00:00:00 +1000

Analysis of the Microsoft 365 DDoS attack by Storm-1359 reveals critical lessons for enterprise application security platforms. Learn advanced Layer 7 DDoS protection strategies and rate limiting techniques for modern applications.

Advanced Anomaly Detection

AC — Mon, 15 May 2023 13:00:00 +1000

Deep dive into Robust Random Cut Forest (RRCF) implementation for real-time anomaly detection in Application Security Platforms. Learn how advanced machine learning algorithms enhance threat detection and automated response capabilities.

CVE-2022-26134

AC — Thu, 02 Jun 2022 00:00:00 +1000

Peakhour clients are protected against CVF-2022-26134 Atlassian Confluence RCE

Intelligent Rate Limiting

AC — Mon, 16 May 2022 13:00:00 +1000

Comprehensive guide to intelligent rate limiting for modern application security platforms. Learn how sophisticated rate limiting protects APIs and web applications from abuse, DDoS attacks, and automated threats whilst maintaining optimal user experience.

Rate limiting

AC — Mon, 16 May 2022 13:00:00 +1000

How can rate limiting protect your web application and the key items to consider when enabling.

Application Performance Optimisation

Dan — Sat, 12 Sep 2020 13:00:00 +1000

A practical primer for finding where website requests lose time, from cache state and origin work to browser rendering.

WordPress Performance Optimisation

Dan — Mon, 27 May 2019 13:00:00 +1000

How to speed up WordPress by separating public cacheable pages from private, expensive, and abused request paths.