Share the minimum needed, in the most controlled way. What each requester really needs, why email is a poor default, redaction, secure portals, TLP labels and remediation evidence.
CVSS Scores or Risk Ratings in Pen Test Reports? Why You Need Both
CVSS measures technical severity, not business risk. What CVSS v4.0 covers, why a High can be low for you, EPSS and KEV signals, what a useful report includes and how to prioritise fixes.
Remote Staff on Personal Devices: How to Protect Company Data
Secure the data and access, not the personal device. Virtual desktops, browser controls and app protection, the controls every approach needs, and when to issue company devices anyway.
SIEM + EDR or XDR? How to Choose Your Detection Stack
SIEM, EDR and XDR overlap but solve different problems. What each does, five questions that decide the architecture, three common patterns and how to control cost.
We Limit Developer Access. Why Are AI Agents Getting Admin Rights?
AI agents should get less default access than a new developer. OWASP Excessive Agency, the controls to enforce outside the prompt, and an access review for agents already running.
Should You Pen Test Your MSP Without Telling Them? How to Do It Safely
Covert tests measure whether your MSP would notice an attack, but need written authorisation, a contract check, rules of engagement and a trusted agent. When to choose announced testing instead.
Should Your Outsourced SOC Report RDP Brute Force Attempts?
Detect every RDP brute force attempt, but escalate only the patterns that matter: success after failures, spraying, privileged targets and internal sources. Plus the exposure fix that quiets the noise.
Is It Worth Pen Testing Office 365? What to Test Instead First
Microsoft secures the platform; attackers exploit your tenant configuration and sign-ins. Why a Microsoft 365 configuration review usually beats a pen test as the first spend.
DMARC Stuck at p=none? How to Reach Reject Without Breaking Email
A DMARC record at p=none reports on spoofing but does not stop it. How to find every sender, fix alignment and move to reject, plus what changed with RFC 9989.
Is a One-Man CISO Role Worth It? Four Things to Check First
The title is not the risk. The risk is accountability without authority. Four conditions to test before you accept a solo security role, what to negotiate before signing, and the interview answers that should make you walk away.