Security operations
Everything I've written on security operations, with the research pieces first. Each one ends with something you can do on Monday.
Dealing with one of these problems yourself? I work with organizations that need answers, not another slide deck. Let's talk.
What's in a five-angle short
Most subjects here are one page with five short sections, always in this order. Each has its own colour inside the article so you can jump to the one you need.
- 1Where I'd start: the first move I'd make, and the question I'd ask before spending anything.
- 2Where plans fail: where plans on this subject usually break, and the assumption I'd test first.
- 3Beyond the jargon: what the subject actually means once the vendor language is stripped out.
- 4What good looks like: the result that would tell you it worked, and the number I'd watch.
- 5The call leaders can't dodge: the decision leadership has to own, and what it needs on the table to make it.
-
How Do You Know Whether Your SOC Is Actually Effective?
Assess SOC effectiveness with tested detection, defensible investigations and verified containment. Expose missed cases, handoff failures and misleading response averages.
-
How Do You Know a Security Control Still Works After a Change?
Keep security-control evidence valid after change: define retesting triggers, detect missing telemetry and bound the time to a defensible decision.
-
How Do You Reconstruct an OT Incident When Clocks Disagree?
Reconstruct OT incidents with timestamp uncertainty, source provenance and causal evidence, then verify time recovery against each function's requirements.
-
How Do You Test API Object Authorization Across Tenants?
Test API authorization with a decision matrix covering tenants, objects, fields, stale permissions and queued work. Learn what evidence supports a release decision.
-
How Do You Test Detection False Positives Before Enabling a Rule?
Test a detection rule with benign lookalikes, held-out data and shadow operation. Separate false-positive rate, alert precision, workload and release evidence.
-
How to Verify DMARC Across Every Legitimate Email Sender
Verify DMARC alignment across mailboxes, applications, vendors and forwarders, with receiver tests and evidence for an enforcement decision.
-
When Vulnerability Scores Disagree, What Should You Fix First?
Reconcile CVSS, EPSS and CISA KEV with asset evidence, business consequences and patch constraints to choose a defensible next action.
-
Alert fatigue
I would not begin alert fatigue by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario...
-
Continuous Monitoring Is Not Continuous Assurance
A dashboard can show a hundred green indicators and still tell me very little about whether an attacker can reach a critical system. Monitoring collects obse...
-
Detection engineering
I would not begin detection engineering by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Nine questions before you sign a managed SOC contract
Outsourcing detection can be the right call. Outsourcing accountability can't be. The contract is where those two get confused, so these are the questions I'...
-
Purple teaming
I would not begin purple teaming by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
-
SIEM architecture
I would not begin SIEM architecture by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
SOAR automation
I would not begin SOAR automation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenar...
-
SOC operating model
I would not begin SOC operating model by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
SOC performance metrics
I would not begin SOC performance metrics by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...
-
SOC staffing
I would not begin SOC staffing by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario ...
-
Telemetry strategy
I would not begin telemetry strategy by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
The Security Dashboard Nobody Can Use
A dashboard can be full of healthy percentages and still leave leadership unable to say whether the organization is safer.
-
Threat hunting
I would not begin threat hunting by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
-
When to retire a detection rule
Every SOC I've looked at has rules nobody remembers writing. They fire, an analyst closes them, and the cycle repeats until someone finally asks what the rul...
-
Why Your SOC Is Busy but Not Effective
A security operations center can be busy around the clock and still miss the incident that matters. I don't find the number of alerts closed particularly rea...
Nothing matches. Try another word, or ask me directly.