Security guides & playbooks

A practical framework for CISOs and security engineers: the five stages, the top risks, and the controls that map to each — then score your own agents.

Retrieval-augmented apps widen the attack surface. A checklist across inputs, retrieval, the model, outputs and tools — with the failure modes to test.

Models, weights, datasets and ML libraries are software too. How to handle provenance, unsafe deserialization, and CVEs in your ML dependencies.

You've got a CycloneDX or SPDX file — now what? How to turn a bill of materials into a fix-first patch queue you can actually work.

The #1 reason security patches get delayed is the fear they'll break something. How to read upgrade risk from the version jump (major vs minor vs patch), where the version number lies, and how to de-risk the rollout — so "we can't upgrade" stops being the blocker.

Which CVE do you fix first? How to combine severity, exploit probability and active exploitation into a defensible, exploited-first order.

Unsupported software stops getting security fixes. How to inventory it, see what is about to go EOL, and plan upgrades before the patches stop.

An SBOM lists what is inside; a VEX says what actually affects you. The statuses, the justifications, and how to author one from a scan.

A no-nonsense playbook: inventory, prioritise, remediate, verify, report — the loop that turns scanning into measurable risk reduction.

The vulnerability-reporting obligations, the 24h/72h clock, the machine-readable SBOM requirement — and a checklist to be ready before the deadline.

What auditors actually want to see for CC7.1 / CC8.1 and Annex A 8.8 — and how to produce that evidence without a spreadsheet marathon.

Both signal a mature security program, but they are not the same thing. The practical differences, and which one to request when assessing a vendor.

A questionnaire is what the vendor says; an SBOM and vulnerability data are independently verifiable. Why you need both to assess a product.

A lightweight TPRM program you can actually run: inventory vendors, tier by risk, assess, and monitor — without drowning in spreadsheets.

How to run a vendor security assessment end to end — scope, questionnaire, independent verification, scoring and sign-off — before you buy.

A SOC 2 report is dense. What to actually check: the type, period, scope, the auditor’s opinion, and — most importantly — the exceptions.

Before you sign: the access, data, compliance and operational controls to confirm — plus the software-vulnerability check most checklists miss.

Teams adopt tools faster than security can review them. How to surface shadow IT, triage it by risk, and bring it under assessment.

An actively-exploited authentication bypass (CVSS 8.6) chained to unauthenticated root code execution on Ivanti Connect Secure — exploited as a zero-day before the fix existed. The affected and fixed versions, and the critical catch: patching alone is NOT enough — you must hunt for compromise.

Two critical, unauthenticated remote-code-execution flaws in PHP core (CVSS 9.2), with exploitation reported. The exact fixed versions, how to tell if you’re affected, interim mitigations, and the end-of-life trap — a patch-now runbook.

A calm, repeatable runbook for the moment a critical bug drops: confirm exposure, scope blast radius, mitigate, patch, and communicate.

Attackers host a fake "outage — download our desktop app" page on a real chatgpt.com share URL and drive traffic with Google Ads. Every phishing tell your users learned fails. How it works, why defences miss it, and the rules that still hold.

Device code phishing walks straight past MFA — nothing is fake, so nothing alerts. Stop it with one Conditional Access policy: what the attack is, the two checkboxes that block it, and what to do if an account is already compromised.

A new laptop isn’t secure just because it’s switched on. The 10-step build — updates, BitLocker, Intune, baselines — plus the step most checklists miss: proving the versions in your image aren’t already vulnerable or end-of-life.

Private name resolution inside your virtual networks with no DNS server to run. What the pieces are (zones, VNet links, Private Resolver), how it keeps DNS off the public internet, and where it quietly cuts your attack surface — plus the limits to plan around.

Remote Desktop quietly caches tiles of every remote screen to your local disk — and they outlive the session. What the cache really is (no, not "secret screenshots"), what investigators can rebuild, and how to disable and clear it.