Articles
Practical writing on security and infrastructure, drawn from what we see in client engagements and written for engineering and security leaders.
Showing 1 to 12 of 20 articles
Featured
Security Leadership22 min read
Perfect security does not exist, and AI is cutting the cost of attack. A CISO’s guide to the threat cost ladder, the board conversation and raising the price of compromising you.
Incident Response15 min read
What to do in the first hour of a ransomware attack and after: containment, evidence, scoping, data theft, paying or not, notification, eradication, recovery order and hardening, with commands.
Hardening Guide21 min read
Step by step hardening for an internet-facing Ubuntu, Debian or RHEL server: SSH, firewalls, kernel settings, sandboxing, auditing, integrity monitoring, backups and verification.
Featured
Incident Response25 min read
A hands-on triage playbook for compromised Windows hosts: memory capture, live response, persistence hunting, event logs, execution artifacts, KAPE and Velociraptor collection.
Featured
Incident Response22 min read
A hands-on triage playbook for compromised Linux servers and containers: memory capture, /proc analysis, SSH keys, logs, persistence hunting, rootkit checks and UAC collection.
Endpoint Security4 min read
Seven endpoint security terms that buyers mix up, what each one actually does on a laptop or server, how they overlap, and which combination makes sense at each stage of maturity.
Tool Comparison3 min read
CrowdStrike, Microsoft Defender for Endpoint, SentinelOne, Cortex XDR, Trend Vision One, Sophos and Elastic compared on detection, response, operations and the environments each one suits.
Tool Comparison3 min read
Microsoft Sentinel, Splunk Enterprise Security, Google Security Operations, Elastic, IBM QRadar and Wazuh compared on pricing model, query language, deployment options and data residency.
Tool Comparison3 min read
Open source feeds, commercial intelligence providers and threat intelligence platforms compared, with a practical way to decide what your team needs before buying any of them.
Cloud Platforms3 min read
The four major cloud platforms compared on strengths, pricing traps, identity, AI and data services, and presence in the Gulf, with guidance on when multi-cloud is worth the cost.
Incident Response5 min read
An advanced, no-fluff guide for the first hour and beyond: severity, evidence handling, containment that does not tip off the attacker, eradication and recovery.
Featured
Security Operations3 min read
Why many SIEM deployments disappoint, how to build one that catches real attacks, and how that foundation makes SOAR automation and AI-assisted analysis worth having.