October 24, 2026
A cyber breach triggers more than an IT response
Who needs to be in the loop when a breach hits, which decisions are not technical, and how tabletop exercises and drills prepare an organization before it happens.
Writing & publications
Field notes
Write-ups drawn from live security programmes: what actually broke, what held, and what I’d do differently.
-
-
October 24, 2026
Insider Threat: Your next hire might be a breach
Fraudulent and AI-assisted candidates, state-sponsored remote workers and malicious insiders turn hiring into a security control. What to verify before, during and after onboarding.
-
October 24, 2026
The value of selecting the right SIEM, threat intelligence source and SOC operation
Proactive detection is a system of three parts: the data and analytics platform, the intelligence that gives alerts context, and the operation that acts on them. How to…
-
October 24, 2026
An integrated internal audit programme for high-compliance regions
How to run one internal audit programme across jurisdictions, regulators, funders, and frameworks, testing each control once instead of multiplying the evidence-collection work.
-
October 24, 2026
Shadow AI is an identity problem, and visibility is the minimum viable control
Why banning AI tools fails, why unauthorized AI access starts at the login, and why SaaS discovery such as LastPass SaaS Monitoring is the right first control, with…
-
September 3, 2026
Integrated Enterprise AI Control Framework
Folding AI-specific controls into an existing ISO 27001 / NIST CSF programme instead of standing up a separate framework nobody maintains.
-
August 6, 2026
Building a SOC with a two-person team
Using an agentic SOC AI (Dropzone AI) to carry alert triage so a two-person team can spend its hours on what actually needs a human.
-
July 9, 2026
What Zero Trust actually breaks first
Notes on the operational and organizational failure points that show up before the technical ones do.