Practical writing from the work — vulnerability management, compliance engineering, and incident response in regulated EU environments.
No articles match. Try fewer words, or check a product on stack check.
KEV digest · 24 Oct 2026CISA added 8 CVEs to its Known Exploited Vulnerabilities catalog in the window 17–23 Oct 2026. Affected: Plex, Arista, Collabora and others. Each entry with EPSS, deadlines and the required action.
read → · every digest at /insights/kev-digest/Active threat · 26 Oct 2026Storm-0940 used stolen ConnectWise app credentials to sign in to Microsoft 365 tenants. How to check service principal sign-ins and audit logs, contain without losing evidence, and audit every high-privilege vendor app.
read →Patch Tuesday · October 2026Microsoft's October 2026 security release fixes 1,407 CVEs: 1 exploited in the wild, 1 publicly disclosed, 77 rated critical. What to patch first, by component and impact.
read → · every month at /insights/patch-tuesday/Quarterly report · Q3 2026Q3 2026 in numbers: 100 vulnerabilities confirmed exploited (CISA KEV), 36,953 CVEs published, 6 linked to ransomware, Microsoft most affected. Original analysis from public data, with the raw numbers to download.
read →Active threat · 23 Oct 2026Critical unauthenticated RCE in the PHP core, patched 21 Oct 2026. Affected versions, finding every PHP runtime, patching and verifying backports, stop-gap mitigations, and what to hunt for in your logs.
read →Vulnerability managementAround 3,000 CVEs are published every month and only a small fraction are ever exploited. How CISA KEV and EPSS turn an impossible patching backlog into a short, defensible priority list.
read →Compliance engineeringWho is in scope, the 24-hour and 72-hour incident reporting cascade, the ten baseline security measures, management liability, and where to start.
read →Identity securityKilling legacy authentication, Conditional Access done right, phishing-resistant MFA for admins, break-glass accounts, app consent, and privileged role hygiene.
read →Compliance engineeringWhat to log, how long to keep it, daily review, time sync, and log integrity — and how to generate the evidence continuously instead of before the audit.
read →Detection engineeringThe honest economics of SIEM: why licensing is the smaller cost, where in-house deployments stall, and the questions that cut through vendor noise.
read →Incident responseScoping with message trace, purging delivered mail, blocking the wave, finding who clicked, and containing compromised accounts.
read →Pipeline securityWhy API keys end up in git history, the three layers of secrets scanning that work, the first hour after a leak, and how short-lived credentials shrink the problem.
read →