Engineering, threat research, product notes.
The work behind the platform — postmortems, detection-engineering writeups, AI architecture decisions, and the operational discipline of running a SOC for SMBs.
Building an incident response retainer from the ground up
Every CISO eventually has the same uncomfortable realization: the night an incident lands is a bad time to be hiring an incident response firm. Here is how we structure a retainer that is actually useful when the call comes — and what the common pitfalls look like.
Phishing simulations that don't blame the user
Most phishing simulation programs become an annual ritual where the security team sends a deceptive email, watches employees click, and then makes them watch a video as punishment. Useful programs do something else entirely.
How to read your first scanner finding without panicking
A finding lands in your inbox titled "Critical: SQL Injection — production-api-1." Your stomach drops. This guide walks you through the next ten minutes — what to read first, what to ignore for now, and how to know whether the alarm is real.