INSIGHTS
Field notes from the work.
Practitioner-written analysis on incident response, security advisory, cloud security, and the cybersecurity decisions facing organizations.
2026.05.14
ADVISORY
6 min
What a vCISO actually does in the first 90 days
The job description rarely matches the actual work. The first three months of a fractional CISO engagement are less about strategy decks and more about answering the questions leadership did not realize they had.
Read
2026.05.07
CLOUD
6 min
Microsoft 365 hardening: five settings to review
Review forwarding, authentication, privileged access, sharing, and audit retention, with licensing and recovery considerations for each.
Read
2026.04.30
IR
3 min
What an IR retainer actually buys you at 2 AM
What a retainer puts in place before the 2 AM call: a practitioner who answers, signed terms, pre-approved authority, and documented context.
Read