Notes from
the field.
Practical writing on testing, compliance and defence, plus the threats and trends worth your attention, for people who make real security decisions.
Penetration test scope checklist
The decisions, accounts, boundaries and evidence to agree before testing starts.
Cloud security review: evidence to collect
What to collect before an AWS or Azure security assessment, and why each item matters.
ISO 27001 evidence readiness
Turn policies into traceable operating evidence before the certification audit.
SOC 2 readiness timeline
The work sequence that should happen before a Type I or Type II examination.
Vulnerability management vs pentesting
Why scanning and pentesting answer different questions — and why you need both.
Security for startups: what to do first
A pragmatic priority list before you have a security team.
Red team vs penetration test
Goals, scope, cost — and which one your organisation actually needs right now.
API security: the forgotten attack surface
Object, property and function boundaries to test beyond the visible interface.
Phishing simulations without wrecking trust
Run them so they build security culture instead of humiliating staff.
Cloud misconfigurations that cause breaches
Public buckets, over-broad IAM, exposed metadata — find them first.
Zero trust, without the buzzwords
What it actually means, and pragmatic first steps for smaller teams.
How much does a penetration test cost?
Real price drivers, and how to avoid paying for a scanner report dressed as a pentest.
SOC 2 Type I vs Type II
How scope, report date and operating-effectiveness periods differ; confirm buyer acceptance.
Securing AI chatbots: an LLM checklist
Prompt injection, data leakage, excessive agency — what to test before launch.
The first 24 hours of an incident
A calm playbook: containment, evidence, communication — and the mistakes to avoid.
The OWASP Top 10, for business leaders
How to use this awareness document without mistaking it for complete testing coverage.
What a penetration test actually is
The difference between a real pentest and an automated scan, and how to prepare for one.
ISO 27001 vs SOC 2: which first?
A plain-language guide to choosing the required certification or examination report.
Prompt injection, explained for builders
How untrusted content affects AI workflows, and how to constrain data and tool access.