Blog
Field notes on security & compliance.
Practical insights on building security programs, passing audits, and adopting AI safely - written by practitioners who've done the work.
Security Operations
Detection workflows, threat hunting, alert triage, and incident response. Real telemetry, real queries.
13 articles →AI-Powered Security
AI agents automating compliance checks, security workflows, and audit evidence generation.
7 articles →Compliance & Audit
SOC 2, PCI DSS, ISO frameworks, control mappings, and audit prep guides.
1 article →Security Strategy
Program building, fractional CISO guidance, roadmaps, and security leadership.
0 articles →Security Operations
13 articlesNot all critical CVEs have the same urgency. Using CISA's SSVC and KEV to build a defensible patch priority.
CISA has been publishing SSVC decision points on new CVEs since 2024 through a public GitHub repo called vulnrichment. Here is what it contains, how to query it, and how to build a filter that separates patch-now from patch-whenever regardless of CVSS score.
Read moreCurrent News, Working Detections: Hunting ClickFix Browser Cache Staging in CrowdStrike
Microsoft Threat Intelligence published indicators for a ClickFix variant that pre-stages VBScript payloads in browser cache as fake PNG files, so there is no outbound fetch at execution time. Here's how to translate those IOCs and behaviors into CQL you can run in CrowdStrike Falcon NGSIEM today.
Read moreTriaging Impact:S3/AnomalousBehavior.Delete: Recoverability First, Attribution Second
When GuardDuty fires on mass S3 deletion, the first triage question is not who did it: it is whether the data is gone for good. A step-by-step playbook using CloudTrail, versioning checks, and CQL hunt queries.
Read moreAI-Powered Security
7 articlesYour GRC platform says encryption is on. An AI agent finds the snapshot that predates the policy.
PCI DSS Requirement 3.5 and SOC 2 CC9.1 both require protecting data at rest. Here is exactly what an AI agent runs and what evidence it produces before your QSA finds the gap you missed.
Read moreAI agents make IAM access reviews faster and more thorough than GRC platforms alone.
PCI DSS Requirement 8 and SOC 2 CC6 both require demonstrating that access to systems is appropriately controlled. Here is exactly what an AI agent runs and what evidence it produces.
Read moreYour GRC platform says CloudTrail is on. An AI agent checks whether the alarms actually fire.
PCI DSS Requirement 10 has 40+ sub-controls covering what you log, where it goes, how long it stays, and whether your alerts reach anyone. Here is exactly what an AI agent runs and what evidence it produces before your QSA finds the gaps.
Read more