Last April, one of the analysts who runs penetration-test writeups for me forwarded a screenshot that stopped my evening cold. It was a login page for our shared research portal — pixel-perfect, right down to the favicon — hosted on a domain with two letters transposed. She had typed her password into it. The only …