Field notes
Plain-English security, minus the fear and the jargon.
Short, practical notes from real engagements with small and mid-sized businesses. What actually goes wrong, and what to do about it, without the vendor pitch.
New here? See what attackers see, scan your domain in about 15 seconds.
Your GRC Lead Is Not the Sidekick. They Are the Other Half of the Brain.
An honest, non-salesy look at using AI and the Model Context Protocol for compliance work. …
Fear Is the Mind-Killer: What Dune Teaches About the First Hour of a Breach
Frank Herbert's Dune says fear is the mind-killer, and that is the truest thing ever …
What Severance Gets Right About Least Privilege
Severance makes walled-off access look like a nightmare. In security it is one of our …
The Security Questionnaire Is Your New Sales Rep
More small businesses are handed a customer's security review as a condition of winning a …
The Email That Looks Like It Came From You
Spoofing lets criminals send email that appears to come from your own domain, with no …
The Phishing Tell They Taught You Is Dead
For twenty years we taught people to catch phishing by spotting bad grammar. Generative AI …
Your Website Is Talking to Attackers Behind Your Back
Your public website and email domain broadcast a surprising amount about how to attack you, …
What Your Cyber Insurance Application Is Really Asking
A client slid the form across the table with the look of a man who …
Two minutes
How ready are you, really?
Answer three quick questions and see roughly where you stand, then take the full ten minute readiness assessment.