November 11, 2026/
Four containment swaps that stop the problem while keeping the record, and the one case where stopping spread comes first.
Blog
- All Posts
- Email Security & BEC
- Incident Response & Forensics
- Managed Security
- Other
- PCI DSS & Compliance
- Ransomware
- System & M365 Hardening
- Threat Briefs
- Training & Careers
November 10, 2026/
A composite BEC case study: why removing a single suspicious MFA method is rarely a complete cleanup, and a containment...
November 4, 2026/
Recovery plans rebuild systems. Incident response decides what is safe to rebuild. Here is where the two differ and how...
October 30, 2026/
A boring, repeatable patching routine: inventory, three dated rings, an emergency lane, and a holiday freeze rule that still allows...
October 28, 2026/
Audit logs only help if they are on, retained long enough and searchable. Six checks you can run this week,...
October 27, 2026/
A composite case study on backup destruction before ransomware, and why containing first and cleaning identity before restoring matters.
October 27, 2026/
A composite case study: a leak announcement names the organization, and responders must scope data theft from evidence, not the...
October 27, 2026/
A composite case study on why patching an exposed gateway is necessary but not sufficient, and what responders check after...
October 27, 2026/
News events can lend phishing urgency and borrowed authority. A nonpartisan guide to staff habits and account response.
October 27, 2026/
Six checks a small IT team can finish in a week: legacy auth, MFA, audit logs, forwarding, admin accounts and...
October 25, 2026/
Two critical PHP flaws (CVE-2026-109618, CVE-2026-109619) have fixes. How to check your build, hunt for signs, contain and patch.
October 25, 2026/
Two critical unauthenticated Next.js flaws and a Node.js security release. How to check exposure, hunt, contain and patch.