Blog
Plain-English writing on cybersecurity frameworks, the tools that put them to work, breaking into the field, and the acronyms worth knowing.
-
Explainer
NERC CIP for Utilities, in Plain English
NERC CIP for people arriving from IT: high, medium, and low impact, the ESP and PSP, the 35-day and 24-hour clocks, CIP-013, and what the RSAW really asks for.
October 19, 2026 · 5 min read -
Explainer
OTP, HOTP, and TOTP: Which One Is Actually Protecting You
SMS codes, counter-based HOTP, and time-based TOTP all answer to the name OTP. One barely counts, and none of them stops a phishing kit. Here is the ranking.
October 15, 2026 · 5 min read -
Spotlight
LLMNR and NBT-NS Poisoning: Find It, Then Turn It Off
Why LLMNR and NBT-NS poisoning still opens most Windows pentests, how to detect it on UDP 5355 and 137, the exact GPO names, and why SMB signing matters more.
October 12, 2026 · 5 min read -
Explainer
All 16 MITRE ATLAS Tactics, AML.TA0000 to AML.TA0015, Explained
All 16 MITRE ATLAS tactics in the order an attack on an AI system runs, why the AML.TA numbers look scrambled, and the two tactics ATT&CK doesn't have.
October 8, 2026 · 6 min read -
Explainer
RMF, Step by Step: How a Federal System Gets Authorized
The seven NIST 800-37 RMF steps in the order teams run them, from the FIPS 199 call to the ATO letter, and why Assess and Authorize are where packages stall.
October 5, 2026 · 6 min read -
Explainer
The 18 CIS Controls v8, Listed and Explained in Plain English
All 18 CIS Controls v8 in official order, what each is for, its first safeguard, and why the two inventories come first. IG1 is 56 safeguards, IG3 is 153.
October 1, 2026 · 6 min read -
Explainer
SCIM: Automating Joiners, Movers, and Leavers
SSO stops the next login. It doesn't remove accounts. How SCIM handles joiners, movers, and leavers, and maps to CIS Controls 5.1, 5.3, 6.1, and 6.2.
September 28, 2026 · 5 min read -
Explainer
PDPA Is Not One Law: Singapore, Thailand, and Malaysia Compared
Singapore, Thailand, and Malaysia each have a PDPA. How their breach clocks, DPO rules, consent, and fines differ, and which one to build a program to.
September 24, 2026 · 6 min read -
Explainer
A Tour of ISO 27001 Annex A, Theme by Theme
Annex A's 93 controls aren't a to-do list. What the 2022 themes changed, and why the justification column is the whole Statement of Applicability.
September 21, 2026 · 6 min read -
Explainer
CIS Controls IG1 for a Small City: Where a Two-Person IT Shop Starts
IG1 was written for small businesses. A city also runs a water utility, a police department under CJIS, and a records law. Here is the working order.
September 17, 2026 · 6 min read -
Explainer
TCP vs UDP: What Security People Actually Need to Know
TCP's handshake is evidence you can cite. UDP hands you a source field a stranger wrote. What that difference changes in your scans and your egress rules.
September 17, 2026 · 5 min read -
Explainer
NIST CSF 2.0: The Subcategories to Start With When You Have No Program
CSF 2.0 has 106 subcategories and you have one security hire. Which eight to do first, in what order, and why Govern comes before the asset inventory.
September 14, 2026 · 6 min read -
Explainer
Tooling for POPIA and PDPA: What a Small Team Actually Needs to Buy
POPIA and PDPA are not GDPR renamed. Which privacy tooling modules are load-bearing for a South African or Singaporean SME, and where a spreadsheet works.
September 14, 2026 · 7 min read -
Explainer
CIS Control 6 on an IG1 Budget: Access Management Without a Platform
CIS Control 6 at IG1 is five safeguards, not an identity project. What 6.1 through 6.5 ask for when your directory is one Microsoft 365 tenant.
September 10, 2026 · 6 min read -
Explainer
SFTP vs FTPS vs TFTP: Picking a File Transfer That Survives an Audit
SFTP rides SSH on one port. FTPS wraps FTP in TLS and drags a passive port range behind it. TFTP has no password field. How to pick and defend one.
September 3, 2026 · 6 min read -
Explainer
DFARS 252.204-7012: What the Clause Actually Requires
The DFARS safeguarding clause has been in defense contracts since 2016. What counts as covered defense information, the 110 controls, and the 72-hour clock.
August 31, 2026 · 6 min read -
Explainer
The Penetration Testing Execution Standard (PTES), Phase by Phase
PTES breaks a penetration test into seven phases. What each phase owes the buyer, how it compares to OSSTMM and WSTG, and what belongs in the SOW.
August 27, 2026 · 6 min read -
Explainer
POPIA Compliance Explained: South Africa's Privacy Law in Practice
South Africa's POPIA borrows GDPR vocabulary and then changes the rules. Here is what a security lead actually has to build to operationalize it.
August 24, 2026 · 6 min read -
Explainer
PDPA vs GDPR: What Actually Changes for a US Company
Singapore and Thailand both call their privacy law the PDPA, and neither one is GDPR. Here is what your existing program covers and what it misses.
August 20, 2026 · 6 min read -
Explainer
How to Remove Yourself From Data Broker Sites (Free and Paid Ways)
Data brokers sell your address, phone, and relatives to anyone who asks. Here is how to opt out by hand for free, and when paying to automate it is worth it.
August 17, 2026 · 6 min read -
Spotlight
Sucuri Review: A WAF for Your Website, Not a Substitute for Patching
An honest look at what the Sucuri website firewall and cleanup service actually protects, where it falls short, and why patching still carries the weight.
August 13, 2026 · 7 min read -
Spotlight
NordPass Review: A Password Manager Is Step One, Not the Whole Plan
An honest review of NordPass: what a password manager genuinely fixes, where it stops helping, and the MFA and passkey layers you still need around it.
August 10, 2026 · 6 min read -
Spotlight
NordVPN Review: What a VPN Actually Protects (and What It Never Will)
An honest look at what NordVPN protects, what no VPN can ever fix, and how to decide whether a consumer VPN belongs in your security setup.
August 6, 2026 · 6 min read -
Career
Your First 90 Days as a Security Leader
A grounded first 90 days plan for a new security leader: assess the program, find the single points of failure, pick three priorities, and prove movement.
August 3, 2026 · 7 min read -
Explainer
SOC 2 Readiness in Plain English
SOC 2 readiness without the jargon: what the Trust Services Criteria cover, how Type I differs from Type II, and how to collect evidence once.
July 30, 2026 · 6 min read -
Spotlight
IAM vs PAM vs CIEM: Sorting Out the Identity Acronyms
IAM, PAM, and CIEM all govern who can do what, but they solve different problems. Here is what each one covers and which gap to close first.
July 28, 2026 · 5 min read -
Career
From Security Analyst to Security Engineer: Making the Jump
A practical path from SOC analyst to security engineer: the skills that matter, how to get real reps before you have the title, and how to prove it.
July 27, 2026 · 5 min read -
Explainer
CIS Controls IG1: The Starter Set Every Small Team Can Actually Do
IG1 is the CIS Controls baseline built for small teams. Here is what it covers, why it stops common attacks, and how to work through it cheaply.
July 25, 2026 · 6 min read -
Career
A Realistic Study Plan to Break Into Cybersecurity
A time-respecting study plan for breaking into cybersecurity: fundamentals, a certification path, hands-on practice, and learning the vocabulary.
July 24, 2026 · 7 min read -
Spotlight
SIEM vs SOAR vs XDR vs EDR: What Each One Actually Does
A plain-English breakdown of SIEM, SOAR, and XDR, plus where EDR and MDR fit, so you can stop treating them as interchangeable buzzwords.
July 24, 2026 · 8 min read -
Explainer
Tier Your AI Use Cases Before They Tier You
Every AI feature needs a lightweight risk-tiering step before launch. Learn the four questions that set the tier and route each use case to the right review.
July 24, 2026 · 8 min read -
Explainer
Unify Your Security Frameworks Into One Control Set
NIST CSF, ISO 27001, SOC 2, and CIS Controls overlap heavily. Learn how one control set and a crosswalk can satisfy all four at once.
July 24, 2026 · 7 min read -
Career
What Cybersecurity Employers Actually Want in 2026
A plain-English map of the ten themes that keep showing up in real cybersecurity job descriptions in 2026, and how to prove each one to a hiring manager.
July 24, 2026 · 8 min read -
Spotlight
Zero Trust Is a Strategy, Not a Product You Buy
Zero Trust is an architecture built on never trust, always verify, assume breach, and least privilege. Here is what that means and how ZTNA beats a VPN.
July 24, 2026 · 8 min read