Security, without the noise.
Short, practical notes on the controls that actually stop attacks, from people who spend their days testing them.
Least privilege: the cheapest control you are not using
Most breaches get worse because an account could do far more than its job required. Trimming access is unglamorous and it works.
Backups are a security control, not an IT chore
Ransomware turned backups into the last line of defence. Here is how to make sure yours survive the same attack that hits production.
Phishing still works. Train for the click that will happen
No awareness program gets the click rate to zero. Design your defences for the day someone types their password into the wrong page.
Why patching still decides most breaches
Zero-days get the headlines, but known vulnerabilities with available fixes remain the most reliable way in. A boring process beats a heroic one.