Insights
Field notes from real engagements.
Notes on what we find, how we test, and what it means for the people who have to fix it.
Compliance is not the same as secure
Passing an audit and resisting an attacker are different objectives. Where they overlap, and where treating them as one gets expensive.
Threat modelling without a two-day workshop
A lightweight version your engineers will actually run each quarter, and the three artefacts worth keeping.
Mailing list
New writing and open cohort dates.
Roughly monthly. Field notes, course announcements, and nothing else: no drip campaign.
Subscribed.
You'll hear from us when there is something worth reading.