Identity · 9 min
A practical path to phishing-resistant MFA
Passkeys and FIDO2 tokens are only effective if enrollment, recovery, and legacy protocols are handled deliberately. Here is the sequence we use.
Resources
Field notes from people who do the work.
No gated white papers written by marketing. These are the checklists, explanations, and operating patterns our analysts use with clients every week.
Free to use
No email required
Featured guide · 18 min read
The first 48 hours of a suspected breach.
Most organizations lose valuable evidence in the first hour because the response is improvised. This guide walks through the decisions that matter: who takes command, what gets isolated, what gets preserved, and when to call counsel.
- A one-page decision tree for containment versus observation
- Evidence preservation steps that do not require a forensics team on standby
- Communication templates for customers, regulators, and staff
Incident response
Playbook
Inside the guide
Hour 0–1
Stabilize
Name an incident commander, open a single timeline, and stop uncontrolled changes.
Hour 1–6
Scope
Confirm the initial access vector, identify affected identities, and preserve logs.
Hour 6–48
Contain & recover
Remove persistence, rotate credentials, and restore from verified clean backups.
Library
Guides worth your time.
Written by practitioners. Updated when the threat landscape changes, not on a content calendar.
Cloud · 12 min
Five IAM mistakes we find in almost every review
Over-permissive roles, unused access keys, and trust policies that quietly grant cross-account access. Each one has a low-effort mitigation.
Ransomware · 7 min
Backups: the difference between an incident and a crisis
Three copies is not a strategy. We cover immutability, restoration drills, and the identity controls that keep attackers away from backup consoles.
Detection · 11 min
Writing alerts your analysts will not mute
High-fidelity detections start with a clear behavior, a known false-positive profile, and a response action. A template and three worked examples.
Program · 8 min
Board reporting that survives a real breach
Stop reporting patch counts. A concise model for communicating exposure, investment, and residual risk without overstating maturity.
Testing · 10 min
How to read a penetration test report
Severity labels are not risk. Learn to separate theoretical findings from exploitable paths, and to challenge remediation timelines constructively.
Interactive checklist
The 12 controls that stop most attacks.
Work through the list with your team. Progress resets when you reload the page.
0 / 12 complete
Why these twelve?
Each item maps to a technique we observe in real intrusions, not a compliance framework. Organizations that complete the list consistently eliminate the cheapest paths an attacker can take.
Need a second opinion?
We will review your current state against this list in a 45-minute working session, free of charge.
Completing every item does not make you unhackable. It does make you an expensive target.
Glossary
Terms without the buzzwords.
Short definitions for the concepts that come up most often in scoping calls and board meetings.
Zero trust is an operating model in which no network location is inherently trusted. Every request is authenticated, authorized, and evaluated against policy using identity, device health, and context. In practice, it means replacing broad network access with per-application access and logging every decision.
A managed security service provider typically monitors alerts and forwards them. Managed detection and response includes investigation, threat hunting, containment support, and continuous tuning. The distinction is whether a human answers the alert with context and a recommended action.
The tester starts with a realistic foothold, such as a standard employee credential or a compromised workstation, rather than from the internet. This measures how far an attacker could move after initial access and whether segmentation, monitoring, and privilege controls actually work.
A public knowledge base of adversary tactics and techniques observed in the wild. Security teams use it to describe attacker behavior consistently and to measure whether detection coverage exists for each stage of an intrusion.
Detection engineering builds and maintains the logic that produces alerts. Threat hunting is a hypothesis-driven search for activity that existing detections missed. Hunting findings should feed back into detection engineering; otherwise the same gap reappears.
A facilitated discussion in which leaders work through a simulated incident using the organization's actual plans, roles, and vendors. The goal is to expose decision bottlenecks and communication gaps before a real event forces the issue.
Go deeper
Bring these guides into your next review.
We are happy to walk your team through any resource on this page — no engagement required.