Explore the library

Hand-drawn sketch: Three properties, lost one at a time. Confidentiality, integrity and availability fail separately.

Security fundamentals

CIA triad

Three properties, lost one at a time

Hand-drawn sketch: Design as if something is already in. Assuming a breach is an argument for containment, not for giving up on prevention.

Security fundamentals

Assume breach

Design as if something is already in

Security fundamentals

Attack surface

More ways in than anyone counts

Security fundamentals

Compensating control

A stand in for the control that will not fit

Security fundamentals

Complexity

Complexity defeats understanding

Security fundamentals

Control

Fitted is not the same as working

Security fundamentals

Residual risk

What is left, and whose name is on it

Security fundamentals

Risk

A scenario becomes a risk when you say how likely

Hand-drawn sketch: Three marks on the hull. How much risk you choose to carry, how far you will let it drift, and what would sink you.

Security fundamentals

Risk appetite

Three marks on the hull

Hand-drawn sketch: Safe in the state it arrives. Secure by default means the basic protections are already on, not waiting to be found.

Security fundamentals

Secure defaults

Safe in the state it arrives

Security fundamentals

Threat

The water, the crack and the wet floor

Hand-drawn sketch: Check where the ground changes. Every point where a request moves between contexts of different trust.

Security fundamentals

Trust boundary

Check where the ground changes

Security fundamentals

Vulnerability

The same crack, three different problems

Hand-drawn sketch: Two things to hand over, one that will not go. More than one independent factor makes a stolen password much less useful.

Identity & access

MFA

Two things to hand over, one that will not go

Hand-drawn sketch: Sign it out, do not keep it. Privileged access brokered for a window, and recorded, rather than held permanently.

Identity & access

PAM

Sign it out, do not keep it

Identity & access

Account recovery

The other lane

Identity & access

Authentication

It only answers the first question

Identity & access

Authorisation

Hiding the button is not a control

Identity & access

Credential stuffing

Posted through every door in turn

Identity & access

Identity proofing

Proved once, checked ever after

Hand-drawn sketch: The armful nobody meant to hand out. Access accumulates as people change roles inside an organisation.

Identity & access

Joiner-mover-leaver

The armful nobody meant to hand out

Identity & access

Just-in-time access

A window, not a standing door

Identity & access

Least privilege

Draw the ring tight

Hand-drawn sketch: Cut for one name only. A passkey replaces a shared secret with a pair, and is bound to the real site.

Identity & access

Passkeys

Cut for one name only

Hand-drawn sketch: Concentrated on purpose. A password manager trades reuse for one place that is worth protecting properly.

Identity & access

Password managers

Concentrated on purpose

Identity & access

Password spraying

Quiet enough to stay under the counter

Hand-drawn sketch: Long, and not already leaked. Modern guidance drops forced complexity rules and routine expiry.

Identity & access

Passwords

Long, and not already leaked

Hand-drawn sketch: Cut to fit one site only. Phishing resistant authenticators are cryptographically bound to the real site.

Identity & access

Phishing-resistant MFA

Cut to fit one site only

Hand-drawn sketch: All of it hangs off one identity. Administrative identities concentrate reach across everything they administer.

Identity & access

Privileged accounts

All of it hangs off one identity

Hand-drawn sketch: Copied faster than it can be pulled back. A secret in code, config, a wiki or chat is already somewhere else.

Identity & access

Secrets management

Copied faster than it can be pulled back

Identity & access

Service accounts

Still running, long after the owner left

Hand-drawn sketch: The band, not the person. A stolen session token skips the checks that have already happened.

Identity & access

Session security

The band, not the person

Hand-drawn sketch: The line moved, the work did not. With SaaS, what is left above the line is the whole of security.

Cloud security

SaaS security

The line moved, the work did not

Hand-drawn sketch: Nobody can read this off a policy. Effective permission comes from roles, inheritance and chained assumptions.

Cloud security

Cloud IAM

Nobody can read this off a policy

Hand-drawn sketch: The tape only goes back so far. Cloud logs have to be enabled, centralised and retained in advance.

Cloud security

Cloud audit logs

The tape only goes back so far

Hand-drawn sketch: Nine firms, one floor. Depend on the same few providers and your failures line up.

Cloud security

Cloud concentration

Nine firms, one floor

Hand-drawn sketch: All the guards face outwards. The way out is the route an intruder actually needs.

Cloud security

Cloud egress

All the guards face outwards

Hand-drawn sketch: Reaching through their hatch. In cloud incidents the logs are on the other side of the partition.

Cloud security

Cloud incident response

Reaching through their hatch

Hand-drawn sketch: Rig the second line first. A key you cannot rotate safely is the real problem.

Cloud security

Cloud key rotation

Rig the second line first

Hand-drawn sketch: It leaks on the way past. Cloud credentials end up in repositories, logs, builds and images.

Cloud security

Cloud keys

It leaks on the way past

Hand-drawn sketch: One switch, one missing wall. The action that turns a feature on is the action that turns exposure on.

Cloud security

Cloud misconfiguration

One switch, one missing wall

Hand-drawn sketch: The score measures the beam. Continuous checks find drift. They do not find what was never listed.

Cloud security

Cloud posture management

The score measures the beam

Hand-drawn sketch: Send the evidence out first. Short lived workloads take their evidence with them.

Cloud security

Ephemeral infrastructure

Send the evidence out first

Hand-drawn sketch: Ask the server to fetch it. Cloud instances keep credentials at an address only they can reach.

Cloud security

Metadata services

Ask the server to fetch it

Hand-drawn sketch: One drum, or four. Running in more than one cloud is a trade, not an upgrade.

Cloud security

Multi-cloud

One drum, or four

Hand-drawn sketch: The lever nobody was watching. Object storage exposes data when access policies allow broader reach than intended.

Cloud security

Public storage

The lever nobody was watching

Hand-drawn sketch: Easy to widen, hard to narrow. Cloud network rules are easy to widen and hard to narrow again, because nobody knows what will break.

Cloud security

Security groups

Easy to widen, hard to narrow

Hand-drawn sketch: Squeeze one end, the other swells. Serverless removes servers from your responsibility, not code, identity, data, dependencies or configuration.

Cloud security

Serverless security

Squeeze one end, the other swells

Hand-drawn sketch: Faster than anyone can write it down. Teams provision cloud services faster than governance finds them, creating data stores and exposure that no inventory, monitoring or offboarding process knows about.

Cloud security

Shadow cloud

Faster than anyone can write it down

Hand-drawn sketch: The line is not where you think. Cloud providers secure some layers and customers secure others, and the line moves by service model.

Cloud security

Shared responsibility

The line is not where you think

Hand-drawn sketch: One wall holds the whole platform up. Multi-tenant platforms rest on one invariant: no tenant can reach another's data or compute.

Cloud security

Tenant isolation

One wall holds the whole platform up

Hand-drawn sketch: A ticket that expires by itself. Giving workloads their own short-lived, verifiable identity removes the need for static credentials that must be stored, shared and rotated.

Cloud security

Workload identity

A ticket that expires by itself

Hand-drawn sketch: It acts, then you find out. An agent is a non-human identity that can act, not just answer.

AI security

AI agents

It acts, then you find out

Hand-drawn sketch: Nobody attacked anything. A common AI incident is not an attack.

AI security

AI data leakage

Nobody attacked anything

Hand-drawn sketch: The filter argues, the reach does not. Guardrails filter inputs and outputs and can be talked around.

AI security

AI guardrails

The filter argues, the reach does not

Hand-drawn sketch: A confident answer nobody checked. An invented package name becomes a security problem the moment someone installs it.

AI security

AI hallucinations

A confident answer nobody checked

Hand-drawn sketch: Every action needs a name behind it. When an agent acts, something has to record whose authority it used.

AI security

AI identity

Every action needs a name behind it

Hand-drawn sketch: Three pens lifted off the paper. The prompt, the retrieval, the tool call and the response all have to be written down.

AI security

AI monitoring

Three pens lifted off the paper

Hand-drawn sketch: Passing once is not passing. Ten runs of the same adversarial test, against two different kinds of thing.

AI security

AI red teaming

Passing once is not passing

Hand-drawn sketch: Check on a line you chose. AI changes the volume and the polish, not what the attacker is actually doing.

AI security

AI-enabled social engineering

Check on a line you chose

Hand-drawn sketch: Written faster than it can be read. Generated code needs the same verification as code somebody typed.

AI security

AI-generated code

Written faster than it can be read

Hand-drawn sketch: Blast radius is what it can reach. The tools and permissions an agent holds set the size of its worst afternoon.

AI security

Agent permissions

Blast radius is what it can reach

AI security

Indirect prompt injection

The instruction nobody typed

Hand-drawn sketch: The data leaves its shape behind. Models can reveal properties of the records they were built from.

AI security

Model inversion

The data leaves its shape behind

Hand-drawn sketch: New parts, the same questions. Models, weights and datasets arrive from registries like any other dependency.

AI security

Model supply chains

New parts, the same questions

Hand-drawn sketch: It copies, and the original stays. A model is an expensive asset that can be taken without being removed.

AI security

Model theft

It copies, and the original stays

AI security

Prompt injection

Read as an order, not as text

Hand-drawn sketch: The path around the desk. Assessment is slow, so the work finds its own way past.

AI security

Shadow AI

The path around the desk

Hand-drawn sketch: Nothing inside the machine was touched. Feed a model different pages and it will tell you different things.

AI security

Training data poisoning

Nothing inside the machine was touched

Hand-drawn sketch: A different number, someone else's bag. The counter checks who you are, then never checks whose it is.

Application security

IDOR/BOLA

A different number, someone else's bag

Hand-drawn sketch: It reads every page and runs none. Static analysis sees the whole of the code and the meaning of very little.

Application security

SAST

It reads every page and runs none

Hand-drawn sketch: Input that finishes your sentence. Unless the sentence was finished before the input arrived.

Application security

SQL injection

Input that finishes your sentence

Hand-drawn sketch: Getting the building to fetch it. The server can reach what the outsider cannot.

Application security

SSRF

Getting the building to fetch it

Hand-drawn sketch: Taking the button away is not a no. Only the server can refuse the request.

Application security

Broken access control

Taking the button away is not a no

Hand-drawn sketch: Every step allowed, the whole thing wrong. The application is used exactly as built, far more often than anyone intended.

Application security

Business logic abuse

Every step allowed, the whole thing wrong

Hand-drawn sketch: People review what rules cannot say. Human review catches intent and context problems that tools cannot express as rules.

Application security

Code review

People review what rules cannot say

Application security

Cross-site scripting

Their script, your browser, the site's privileges

Hand-drawn sketch: The points decide what gets built. When a build system can resolve a package name from more than one source, whoever controls the source with higher precedence controls the build.

Application security

Dependency confusion

The points decide what gets built

Application security

Fuzzing

Feed it nonsense until something gives

Application security

Injection

Data read as an instruction

Hand-drawn sketch: The control nobody ever asked for. Some weaknesses are decisions, not defects: a rate limit never specified, an approval step never required.

Application security

Insecure design

The control nobody ever asked for

Hand-drawn sketch: Whatever arrives goes on the record. Binding request data straight onto internal objects lets a user set fields the interface never offered.

Application security

Mass assignment

Whatever arrives goes on the record

Hand-drawn sketch: A small tap on a very large pipe. Requests that are individually valid can be ruinous in aggregate, consuming compute, memory or paid third-party calls.

Application security

Resource exhaustion

A small tap on a very large pipe

Hand-drawn sketch: Faultless code, leaking system. Writing code carefully removes implementation flaws.

Application security

Secure coding

Faultless code, leaking system

Hand-drawn sketch: Sound equipment, shipped as it stands. Secure software deployed with unsafe defaults, unnecessary features or wrong settings is insecure software.

Application security

Security misconfiguration

Sound equipment, shipped as it stands

Hand-drawn sketch: Four tests, four questions. A scan, a penetration test, a red team and a bug bounty are not interchangeable.

Application security

Security testing

Four tests, four questions

Hand-drawn sketch: Everything upstream arrives with it. An application inherits whatever it includes, and whatever builds and ships it.

Application security

Vulnerable dependencies

Everything upstream arrives with it

Hand-drawn sketch: Used as designed, at a speed nobody has. Enumeration and scraping are legitimate calls in an impossible pattern.

API security

API abuse

Used as designed, at a speed nobody has

API security

API authentication

Proof that lasts, or proof that expires

Hand-drawn sketch: Checked at the door, not at the room. APIs prove who is calling, then hand over whichever record was asked for.

API security

API authorisation

Checked at the door, not at the room

Hand-drawn sketch: A gate guards one road. Anything that reaches the same place another way meets no policy at all.

API security

API gateways

A gate guards one road

Hand-drawn sketch: Controls end where the light does. You cannot secure, monitor or retire an API you do not know exists.

API security

API inventory

Controls end where the light does

Hand-drawn sketch: A key identifies the holder. Which is not the same as identifying whoever you meant to let in.

API security

API keys

A key identifies the holder

Hand-drawn sketch: Logged the call, not the contents. Most API logs record that a request succeeded, never which objects it returned.

API security

API observability

Logged the call, not the contents

Hand-drawn sketch: The caller writes the query. In GraphQL the client chooses the shape and the depth, and everything that follows.

API security

GraphQL security

The caller writes the query

Hand-drawn sketch: Granted once, open ever since. A scope is what an app may do on your behalf until somebody turns it off.

API security

OAuth scopes

Granted once, open ever since

Hand-drawn sketch: The screen crops it, the response does not. Returning the whole object and trusting the client to hide the rest is not hiding.

API security

Excessive data exposure

The screen crops it, the response does not

Hand-drawn sketch: Machines prove themselves to each other. A secret that never expires has to be trusted forever. An issued identity does not.

API security

Machine-to-machine trust

Machines prove themselves to each other

Hand-drawn sketch: Where do you set the bar?. Rate limiting guards a finite resource. Choosing the threshold is the hard part.

API security

Rate limits

Where do you set the bar?

Hand-drawn sketch: Only the shapes you declared. Strict validation turns every request away at the door unless it already fits.

API security

Schema validation

Only the shapes you declared

Hand-drawn sketch: Strangers get searched, partners walk in. What a third party API returns is untrusted input, however respectable the source.

API security

Unsafe consumption of APIs

Strangers get searched, partners walk in

Hand-drawn sketch: The old counters are still open. Versions pile up, and the ones nobody maintains keep answering anyway.

API security

Versioning

The old counters are still open

Hand-drawn sketch: A door you opened for someone else. A webhook endpoint is public, so it has to judge every caller and every repeat.

API security

Webhooks

A door you opened for someone else

Hand-drawn sketch: Reviewed here, altered in transit. The build sits between the last look and the first trust, so it is worth guarding.

Software supply chain & DevSecOps

CI/CD

Reviewed here, altered in transit

Hand-drawn sketch: The fence does not go all the way round. Required review is a real control, right up to the point where somebody can skip it.

Software supply chain & DevSecOps

Branch protection

The fence does not go all the way round

Hand-drawn sketch: A signature nobody checks. Signing proves an artefact came from a particular key and has not changed since.

Software supply chain & DevSecOps

Code signing

A signature nobody checks

Hand-drawn sketch: Held still, or left open. Pinning a dependency makes builds reproducible and stops you receiving fixes.

Software supply chain & DevSecOps

Dependency pinning

Held still, or left open

Hand-drawn sketch: The machine with the longest reach. Developer machines hold tokens that reach source control, registries, cloud and production.

Software supply chain & DevSecOps

Developer credentials

The machine with the longest reach

Hand-drawn sketch: The path people actually take. Security tooling developers cannot live with gets bypassed, and the bypass becomes the real process.

Software supply chain & DevSecOps

Developer experience

The path people actually take

Hand-drawn sketch: Start clean, or inherit everything. Build runners that are destroyed after each job stop one compromised build from contaminating the next.

Software supply chain & DevSecOps

Ephemeral runners

Start clean, or inherit everything

Hand-drawn sketch: The name on the tin. A registry entry is a name, not a vetting, and a name is not an identity.

Software supply chain & DevSecOps

Package registries

The name on the tin

Software supply chain & DevSecOps

Provenance

Who signed it, and what made it

Hand-drawn sketch: The gate that stopped being a decision. Approval gates put a human decision between code and production.

Software supply chain & DevSecOps

Release approvals

The gate that stopped being a decision

Hand-drawn sketch: Found is not fixed. Scanning finds secrets in code and history.

Software supply chain & DevSecOps

Secret scanning

Found is not fixed

Hand-drawn sketch: The handle that was never fitted. Embedding security-minded engineers in delivery teams works when the role carries time and authority.

Software supply chain & DevSecOps

Security champions

The handle that was never fitted

Hand-drawn sketch: Gates earn the right to stop you. A gate that regularly blocks delivery gets switched off, and a gate that never blocks anything is decoration.

Software supply chain & DevSecOps

Security gates

Gates earn the right to stop you

Hand-drawn sketch: Earlier is cheaper, not someone else's job. Finding problems earlier is cheaper.

Software supply chain & DevSecOps

Shift left

Earlier is cheaper, not someone else's job

Software supply chain & DevSecOps

Source control

The ledger is also the lever

Hand-drawn sketch: A catalogue number, not a verdict. A CVE identifier is a catalogue number so everyone can refer to the same flaw.

Vulnerability management

CVE

A catalogue number, not a verdict

Vulnerability management

CVSS

Four dials, one gets turned

Hand-drawn sketch: The same number, wherever it sits. CVSS Base measures the intrinsic severity of a flaw, the same wherever it appears.

Vulnerability management

CVSS Base score

The same number, wherever it sits

Hand-drawn sketch: The adjusters nobody turns. Environmental metrics adjust a score for your deployment: what the asset does, what compensations exist, what impact would follow.

Vulnerability management

CVSS Environmental metrics

The adjusters nobody turns

Vulnerability management

CVSS Threat metrics

The dial that looks outside

Hand-drawn sketch: Same crack, different consequence. The same flaw carries different urgency depending on what the affected system does and who can reach it.

Vulnerability management

Asset criticality

Same crack, different consequence

Hand-drawn sketch: Break the glass, but name the hand first. Actively exploited critical flaws justify bypassing normal change control.

Vulnerability management

Emergency patching

Break the glass, but name the hand first

Hand-drawn sketch: Standing still is not staying safe. Unsupported software does not stay as secure as it was.

Vulnerability management

End-of-life software

Standing still is not staying safe

Vulnerability management

Exploitability

How likely, then what now

Hand-drawn sketch: Pull on the thread that reaches. Prioritising by what an attacker can actually reach and use reorders work around reachability rather than around the number of findings.

Vulnerability management

Exposure management

Pull on the thread that reaches

Hand-drawn sketch: Nothing found is not nothing there. A clean scan means the tool found nothing it knows how to find.

Vulnerability management

False negatives

Nothing found is not nothing there

Vulnerability management

False positives

Wrong often enough to be ignored

Hand-drawn sketch: A footprint proves it. Evidence that something is actively exploited beats a high theoretical severity.

Vulnerability management

Known exploited vulnerabilities

A footprint proves it

Hand-drawn sketch: The gap the fix never closed. Most successful intrusions use flaws that were patched long ago.

Vulnerability management

N-days

The gap the fix never closed

Vulnerability management

Patching

Speed comes from the way back

Hand-drawn sketch: Move the label, not the machine. Remediation targets measure the work you agreed to track.

Vulnerability management

Remediation SLAs

Move the label, not the machine

Hand-drawn sketch: Coverage measures the pointing. A scan reports what the tool can see in what it was pointed at.

Vulnerability management

Scanner coverage

Coverage measures the pointing

Hand-drawn sketch: A plaster over the crack. Blocking the known attack buys time. It does not mend the flaw.

Vulnerability management

Virtual patching

A plaster over the crack

Hand-drawn sketch: The tap is faster than the drain. Discovery outpaces remediation, and keeps doing so.

Vulnerability management

Vulnerability backlog

The tap is faster than the drain

Hand-drawn sketch: One word, three meanings. A flaw with no fix, the code that works it, and the attack itself.

Vulnerability management

Zero-days

One word, three meanings

Hand-drawn sketch: The way back, rehearsed. Most self inflicted outages arrive through change.

Architecture & resilience

Change management

The way back, rehearsed

Hand-drawn sketch: Pull it on purpose. Break one thing under control, then see what else goes dark.

Architecture & resilience

Chaos engineering

Pull it on purpose

Hand-drawn sketch: Three legs, one root. Safeguards fail together when they share something underneath.

Architecture & resilience

Common-mode failure

Three legs, one root

Hand-drawn sketch: Every dial started here. Manual fixes, emergency changes and half finished scripts. None of them ring.

Architecture & resilience

Configuration drift

Every dial started here

Hand-drawn sketch: Printed once, known by everyone. A factory default is public the day the product ships.

Architecture & resilience

Default credentials

Printed once, known by everyone

Hand-drawn sketch: Drawn before, or drawn during. Most organisations learn what depends on what in the middle of an outage.

Architecture & resilience

Dependency mapping

Drawn before, or drawn during

Hand-drawn sketch: Which way does it fail?. When a control stops working it either holds everyone out or lets everyone through.

Architecture & resilience

Fail secure

Which way does it fail?

Hand-drawn sketch: Drop the ballast, stay in the air. A system can be built to shed the parts that are not essential.

Architecture & resilience

Graceful degradation

Drop the ballast, stay in the air

Architecture & resilience

Hardening

Fold away what you never use

Hand-drawn sketch: Always open is open to everyone. Availability is an objective of its own, and it competes with protection.

Architecture & resilience

High availability

Always open is open to everyone

Architecture & resilience

Legacy systems

You cannot change it, so you build around it

Hand-drawn sketch: Two of everything, one of the thing that counts. Copies only remove a dependency if they are able to fail separately.

Architecture & resilience

Redundancy

Two of everything, one of the thing that counts

Hand-drawn sketch: A lever long enough to move everything. Standing remote admin access is convenient in exactly the way it is dangerous.

Architecture & resilience

Remote administration

A lever long enough to move everything

Architecture & resilience

Resilience

Built to bend, built to come back

Hand-drawn sketch: The box goes, the threads stay. Switching a system off removes the hardware and nothing else.

Architecture & resilience

Secure decommissioning

The box goes, the threads stay

Hand-drawn sketch: Written in ice. An indicator names what the attacker used, and using something else is cheap.

Detection & SOC

IOCs

Written in ice

Detection & SOC

SIEM

One hopper, and someone at the spout

Hand-drawn sketch: One card, every tool. Orchestration carries the step you chose to each system, without retyping.

Detection & SOC

SOAR

One card, every tool

Hand-drawn sketch: The screens are the scenery. A security operations centre is roles, procedures and practice.

Detection & SOC

SOC

The screens are the scenery

Hand-drawn sketch: One stamp, ten thousand times. Automation applies your judgement at machine speed, including where it was wrong.

Detection & SOC

SOC automation

One stamp, ten thousand times

Hand-drawn sketch: The hand learns the shortcut. Volume does not only cost time. It teaches the reflex that misses the real one.

Detection & SOC

Alert fatigue

The hand learns the shortcut

Hand-drawn sketch: New shoes, same walk. A technique is dearer for an attacker to change than a file or an address.

Detection & SOC

Behavioural detection

New shoes, same walk

Hand-drawn sketch: Six fitted, one rings. A coverage map records what was written, not what sounds when it matters.

Detection & SOC

Detection coverage

Six fitted, one rings

Hand-drawn sketch: Every detection needs a tag. Detections need a hypothesis, a data source, testing and upkeep.

Detection & SOC

Detection engineering

Every detection needs a tag

Hand-drawn sketch: The month you no longer hold. Retention is set for cost and privacy. It is spent on investigations.

Detection & SOC

Log retention

The month you no longer hold

Hand-drawn sketch: The bucket that never moves. Logs help only if they are collected, kept, reachable and actually read.

Detection & SOC

Logging

The bucket that never moves

Hand-drawn sketch: The average is not the story. Faster detection shortens the attacker working time. One number hides the rest.

Detection & SOC

Mean time to detect

The average is not the story

$Hand-drawn sketch: Right almost every time, and still mostly wrong. When malicious activity is a tiny fraction of all activity, even a highly accurate detection produces mostly false alarms.$

Detection & SOC

Signal and noise

Right almost every time, and still mostly wrong

Detection & SOC

Threat hunting

A sentence, not a siren

Hand-drawn sketch: It only counts if you turn. Intelligence is information that changes a decision.

Detection & SOC

Threat intelligence

It only counts if you turn

Hand-drawn sketch: Everything happened. Reconstructing an incident means ordering events across many systems.

Detection & SOC

Time synchronisation

Everything happened

Detection & SOC

Triage

Closed on purpose, not by accident

Hand-drawn sketch: The gap you agreed to lose. Recovery point objective is how much data you have decided you can afford to lose, expressed as time.

Incident response

RPO

The gap you agreed to lose

Hand-drawn sketch: The number you wrote, the number you ran. Recovery time objective is the target for restoring a service.

Incident response

RTO

The number you wrote, the number you ran

Hand-drawn sketch: As good as its paperwork. Evidence is only as good as the record of who held it and whether it could have changed.

Incident response

Chain of custody

As good as its paperwork

Incident response

Containment

The mop is not the repair

Hand-drawn sketch: The bridge cannot answer these. A major incident quickly stops being a technical problem.

Incident response

Crisis management

The bridge cannot answer these

Hand-drawn sketch: Allowed to say stop. Isolating systems and telling outsiders both need someone already empowered to decide.

Incident response

Decision authority

Allowed to say stop

Hand-drawn sketch: It evaporates from the top. Containment and preservation pull apart, and the most volatile evidence goes first.

Incident response

Forensic preservation

It evaporates from the top

Hand-drawn sketch: A second string. Plan for the day your normal channel turns out to be part of the incident.

Incident response

Incident communications

A second string

Hand-drawn sketch: Never in that order. The five stages are the shape of response, but an incident moves between them all day.

Incident response

Incident response lifecycle

Never in that order

Hand-drawn sketch: What came out of the bottom. The output of a review is a short list of changes somebody owns, not a document.

Incident response

Lessons learned

What came out of the bottom

Incident response

Playbooks

A floor, not a script

Hand-drawn sketch: The receipt you get. Paying may restore nothing, and it cannot unpublish what has already been taken.

Incident response

Ransom decisions

The receipt you get

Hand-drawn sketch: Open it before you need it. A backup that has never been restored is a hypothesis, not a capability.

Incident response

Restoration testing

Open it before you need it

Hand-drawn sketch: The hole is not the pressure. Stopping at initial access fixes one path and leaves the condition behind it.

Incident response

Root cause

The hole is not the pressure

Hand-drawn sketch: Where response begins. Response starts at the judgement that turns one event into an incident.

Incident response

Security events

Where response begins

Hand-drawn sketch: The quick bit is not the job. Fast isolation buys hours.

Incident response

Short-term containment

The quick bit is not the job

Hand-drawn sketch: The blanks show up in the room. Talking through an incident in advance exposes what nobody had decided: who calls it, who can shut things down, who talks to customers.

Incident response

Tabletop exercises

The blanks show up in the room

Hand-drawn sketch: It watches the doors it knows about. Data loss prevention catches sensitive data leaving through monitored routes.

Data protection & privacy

DLP

It watches the doors it knows about

Data protection & privacy

Anonymisation

It only takes three ordinary facts

Hand-drawn sketch: Rows are not the measure. Breach severity depends on what was exposed, to whom and what harm follows, not how many rows.

Data protection & privacy

Data breach impact

Rows are not the measure

Hand-drawn sketch: Labels that change the handling. Proportionate protection requires knowing which data matters.

Data protection & privacy

Data classification

Labels that change the handling

Hand-drawn sketch: Deleted is not the same as gone. Data risk changes at every stage from collection to disposal, and disposal receives the least attention.

Data protection & privacy

Data lifecycle

Deleted is not the same as gone

Hand-drawn sketch: Only as much as the job needs. Masking shows only as much of a value as the task requires, reducing how many people ever see the whole thing.

Data protection & privacy

Data masking

Only as much as the job needs

Hand-drawn sketch: The safest record is the one you never held. The cheapest way to protect data is not to hold it.

Data protection & privacy

Data minimisation

The safest record is the one you never held

Hand-drawn sketch: Answerable, not owner. Someone must be accountable for decisions about each dataset: classification, access, retention and acceptable use.

Data protection & privacy

Data ownership

Answerable, not owner

Hand-drawn sketch: The decision nobody made. Almost nobody decides to keep data forever; they never decide to delete it.

Data protection & privacy

Data retention

The decision nobody made

Hand-drawn sketch: One word, three questions. Where data sits, whose law reaches it and whether it is legally required to stay put are three separate questions.

Data protection & privacy

Data sovereignty

One word, three questions

Hand-drawn sketch: The first line, not the last. Monitoring the workforce for security purposes must be necessary, proportionate and lawful, and what that requires differs by jurisdiction.

Data protection & privacy

Employee monitoring

The first line, not the last

Hand-drawn sketch: Lay it with the pipes. Privacy built into architecture and defaults is achievable; privacy retrofitted after collection begins usually is not.

Data protection & privacy

Privacy by design

Lay it with the pipes

Hand-drawn sketch: It is still real people. Real personal data in test environments extends production sensitivity into places with development controls and far wider access.

Data protection & privacy

Production data in testing

It is still real people

Hand-drawn sketch: The number still points back. Replacing direct identifiers reduces exposure but does not make data anonymous.

Data protection & privacy

Pseudonymisation

The number still points back

Hand-drawn sketch: It only fits one slot. Data gathered for one purpose does not automatically become available for another.

Data protection & privacy

Purpose limitation

It only fits one slot

Hand-drawn sketch: The carbon copy. Logs quietly become a second copy of your most sensitive data, with broader access, longer retention and weaker controls than the system that produced it.

Data protection & privacy

Secrets in logs

The carbon copy

Hand-drawn sketch: Only what is in the circle. Every export, copy and abandoned dataset is a version of your data outside the controls the original has.

Data protection & privacy

Shadow data

Only what is in the circle

Hand-drawn sketch: It is also a diary. The telemetry that makes investigation possible is also a detailed record of what people did.

Data protection & privacy

Telemetry privacy

It is also a diary

Data protection & privacy

Tokenisation

One store holds the real thing

Hand-drawn sketch: It cannot be copied. It can be asked. A hardware security module resists key extraction, not a compromised caller.

Cryptography

HSMs

It cannot be copied. It can be asked

Hand-drawn sketch: Any of them can say yes. A certificate authority vouches that a key belongs to a name.

Cryptography

Certificate authorities

Any of them can say yes

Hand-drawn sketch: Too short to do by hand. Public certificate lifetimes are being shortened in steps toward 47 days by 2029.

Cryptography

Certificate expiry

Too short to do by hand

Cryptography

Crypto agility

How fast could you swap it?

Cryptography

Cryptographic trust

Everything hangs from a list

Cryptography

Digital signatures

It proves a key, not a promise

Cryptography

Encryption

It all turns on the handle

Cryptography

Encryption at rest

It answers theft, not access

Cryptography

Encryption in transit

Three states, one still bare

Hand-drawn sketch: Yesterday's key no longer exists. Recording the traffic is easy. Getting the key later does not help.

Cryptography

Forward secrecy

Yesterday's key no longer exists

Hand-drawn sketch: The mark, not the message. A hash is a one way mark. Same input, same mark, every single time.

Cryptography

Hashing

The mark, not the message

Cryptography

Key management

The maths is not the weak link

Hand-drawn sketch: Turn it before you need to. How long a key should live follows how it is used and exposed.

Cryptography

Key rotation

Turn it before you need to

Hand-drawn sketch: Twice with the same key. Some values are safe only while they never come round again.

Cryptography

Nonce reuse

Twice with the same key

Hand-drawn sketch: Cost per guess. A password store is only as good as the work each guess costs.

Cryptography

Password hashing

Cost per guess

Hand-drawn sketch: The half that is not in the database. A secret kept somewhere else helps only while it really is somewhere else.

Cryptography

Peppers

The half that is not in the database

Hand-drawn sketch: Captured today, opened later. The standards are published. The reason to move is the recording, not the machine.

Cryptography

Post-quantum cryptography

Captured today, opened later

Hand-drawn sketch: One half in public. Anyone can do one part of the operation. Only the holder can do the other.

Cryptography

Public-key cryptography

One half in public

Hand-drawn sketch: If it can be guessed, it is not random. Strong algorithms rest on values an attacker must not be able to predict.

Cryptography

Randomness

If it can be guessed, it is not random

Hand-drawn sketch: Same password, different stored value. A unique salt per password means identical passwords produce different stored values, so an attacker must attack each separately and cannot use precomputed tables.

Cryptography

Salts

Same password, different stored value

Hand-drawn sketch: Something finite runs out. Denial of service exhausts something finite: bandwidth, connections, compute or a metered downstream service.

Networks

DDoS

Something finite runs out

Hand-drawn sketch: The sign, not the building. DNS decides where your traffic actually goes, which makes the registrar account as security-critical as the servers it points to, and usually far less well defended.

Networks

DNS

The sign, not the building

Hand-drawn sketch: Everyone waves it through. Protocols permitted everywhere and inspected nowhere make attractive covert channels.

Networks

DNS tunnelling

Everyone waves it through

Hand-drawn sketch: The question moved, not the answer. Checking a device's identity and health before granting access is sound.

Networks

NAC

The question moved, not the answer

Hand-drawn sketch: One of you shows a name. Correctly configured TLS protects data in transit and proves the server's identity to the client.

Networks

TLS

One of you shows a name

Hand-drawn sketch: It protects the road, not the ends. A VPN protects traffic between two points and can extend network access.

Networks

VPNs

It protects the road, not the ends

Hand-drawn sketch: Two signs, one name. A rogue access point imitating a trusted network gets devices to associate with it.

Networks

Wi-Fi evil twins

Two signs, one name

Hand-drawn sketch: The gap only stops the wire. Isolation removes remote network paths, not all paths.

Networks

Air gaps

The gap only stops the wire

Hand-drawn sketch: Private, with whoever turned up. Encryption without checking identity gives you a private conversation with whoever is actually there.

Networks

Certificate validation

Private, with whoever turned up

Hand-drawn sketch: One gate in, none between. The perimeter is inspected. What services say to each other usually is not.

Networks

East-west traffic

One gate in, none between

Hand-drawn sketch: It checks the ticket, not the errand. A firewall enforces reach. It has no opinion about what allowed traffic is doing.

Networks

Firewalls

It checks the ticket, not the errand

Hand-drawn sketch: Sideways, on borrowed trust. After the way in, attackers travel toward what they want using what each machine accepts.

Networks

Lateral movement

Sideways, on borrowed trust

Hand-drawn sketch: Both ends think the line is direct. An on path attacker repeats a real login as it happens, then keeps what that login produced.

Networks

Man-in-the-middle

Both ends think the line is direct

Networks

Microsegmentation

A door between every pair

Hand-drawn sketch: The envelope, not the letter. Encryption hides what was said. It does not hide who wrote to whom, how much, or when.

Networks

Network monitoring

The envelope, not the letter

Networks

Remote access

A room at a time, every time

Networks

Segmentation

How far the fall goes

Hand-drawn sketch: Three small favours, one long ladder. Cluster permissions combine. A binding that looks narrow can still reach the top.

Containers & Kubernetes

Kubernetes RBAC

Three small favours, one long ladder

Hand-drawn sketch: A label is not a lid. Calling something a Secret says nothing about whether anything is keeping it shut.

Containers & Kubernetes

Kubernetes secrets

A label is not a lid

Hand-drawn sketch: One door, and everything uses it. Three ways in, one place the cluster can still say no.

Containers & Kubernetes

Admission control

One door, and everything uses it

Hand-drawn sketch: The handle for the whole platform. It does not matter what gets hold of it.

Containers & Kubernetes

Cluster admin

The handle for the whole platform

Hand-drawn sketch: Through the floor, not the wall. The isolation model exists to stop exactly this one move.

Containers & Kubernetes

Container escape

Through the floor, not the wall

Hand-drawn sketch: Whatever is on the stamp. An image is a template, and the template gets replicated.

Containers & Kubernetes

Container images

Whatever is on the stamp

Containers & Kubernetes

Containers

One floor, thinner walls

Hand-drawn sketch: The same clock for both. A short life takes the foothold and the record of it together.

Containers & Kubernetes

Ephemeral containers

The same clock for both

Hand-drawn sketch: Two different questions. A scan looks inside. Provenance says where the thing came from.

Containers & Kubernetes

Image provenance

Two different questions

Hand-drawn sketch: Only what is on the list. And only as the list stood at the moment it ran.

Containers & Kubernetes

Image scanning

Only what is on the list

Hand-drawn sketch: A line painted on the floor. It says where things belong. It does not hold anybody back.

Containers & Kubernetes

Namespace isolation

A line painted on the floor

Hand-drawn sketch: Open until you say otherwise. Segmentation inside a cluster has to be declared.

Containers & Kubernetes

Network policies

Open until you say otherwise

Hand-drawn sketch: One trolley over every node. The control plane can schedule any workload on any node.

Containers & Kubernetes

Orchestrator control plane

One trolley over every node

Hand-drawn sketch: A bar you have to pass under. Pod-level restrictions limit what a workload may do to the host.

Containers & Kubernetes

Pod security

A bar you have to pass under

Hand-drawn sketch: The drawing, and the thing running. Build-time checks describe what you intended to deploy.

Containers & Kubernetes

Runtime security

The drawing, and the thing running

Containers & Kubernetes

Sidecars

Inside the same ring

Hand-drawn sketch: It has to reach everything. Pipelines need credentials to nearly everything they deploy to, which concentrates privilege by design.

Supply chain & third parties

CI/CD secrets

It has to reach everything

Hand-drawn sketch: The list, and the verdict. An SBOM lists what is inside the software.

Supply chain & third parties

SBOMs

The list, and the verdict

Hand-drawn sketch: Five taps, one main. Your suppliers have suppliers.

Supply chain & third parties

Fourth-party risk

Five taps, one main

Hand-drawn sketch: One post holds the shelf. Critical components are often maintained by very few people, unpaid, in their own time.

Supply chain & third parties

Maintainer burnout

One post holds the shelf

Hand-drawn sketch: The beam does not tip by itself. Open source is not inherently more or less secure than closed source.

Supply chain & third parties

Open-source risk

The beam does not tip by itself

Hand-drawn sketch: The rope nobody pulls. An audit right never exercised is a clause, not a control.

Supply chain & third parties

Right to audit

The rope nobody pulls

Supply chain & third parties

Secure by design

Fitted at the factory, or not at all

Hand-drawn sketch: A lot of answering, very little knowing. An unaudited questionnaire measures the care taken filling it in.

Supply chain & third parties

Security questionnaires

A lot of answering, very little knowing

Hand-drawn sketch: Inside, whether the diagram says so or not. A supplier with privileged access has already moved your trust boundary.

Supply chain & third parties

Supplier access

Inside, whether the diagram says so or not

Hand-drawn sketch: The contract ends. The connections do not. Ending a relationship is not the same as removing a supplier.

Supply chain & third parties

Supplier offboarding

The contract ends. The connections do not

Hand-drawn sketch: One tank, every tap. Compromise a supplier once and you have reached all of their customers.

Supply chain & third parties

Supply-chain attacks

One tank, every tap

Hand-drawn sketch: The work moves. The answering does not. Outsourcing does not move the consequence, the duty or the blame.

Supply chain & third parties

Third-party risk

The work moves. The answering does not

Hand-drawn sketch: You chose one. You got the root system. Most of the code in an application arrived as a dependency of a dependency.

Supply chain & third parties

Transitive dependencies

You chose one. You got the root system

Hand-drawn sketch: The same update, everywhere at once. Standardising on fewer suppliers correlates your failure with everybody else.

Supply chain & third parties

Vendor concentration

The same update, everywhere at once

Hand-drawn sketch: Which rooms, and what stops when they stop. A certificate answers neither question.

Supply chain & third parties

Vendor due diligence

Which rooms, and what stops when they stop

Hand-drawn sketch: Three claims, three kinds of evidence. A certificate, an attestation report and a red team are not interchangeable.

Governance & risk

Assurance

Three claims, three kinds of evidence

Hand-drawn sketch: Three things, not three hundred. A board needs the material risks, the actions, and the decisions asked of it.

Governance & risk

Board reporting

Three things, not three hundred

Hand-drawn sketch: True about that day. A certificate photographs the baseline. It does not hold it still.

Governance & risk

Compliance

True about that day

Hand-drawn sketch: Three different claims. It is there. It goes off. The fire goes out. Only one of those is the point.

Governance & risk

Control effectiveness

Three different claims

Hand-drawn sketch: The stand everyone plays from. Governance is not another instrument. It is the part the others read.

Governance & risk

Cyber governance

The stand everyone plays from

Hand-drawn sketch: Where the cover stops. Underwriting sets the controls. The edge of the policy is the argument.

Governance & risk

Cyber insurance

Where the cover stops

Hand-drawn sketch: Temporary, for eleven years. An exception nobody owns and nobody dated quietly becomes the building.

Governance & risk

Exceptions

Temporary, for eleven years

Governance & risk

Policy

The sign slows nobody

Hand-drawn sketch: Whose yes was it?. The same crack in both pipes. Only one of them was a decision.

Governance & risk

Risk acceptance

Whose yes was it?

Hand-drawn sketch: Every bag on one hook. Security advises and operates. It does not own the objective at stake.

Governance & risk

Risk owners

Every bag on one hook

Hand-drawn sketch: Is it connected to anything?. A risk register is only worth keeping if something changes because of it.

Governance & risk

Risk registers

Is it connected to anything?

Hand-drawn sketch: Only the bill moves. Insurance and contracts change who pays, and change nothing else.

Governance & risk

Risk transfer

Only the bill moves

Hand-drawn sketch: Which way does it send you?. A security metric earns its place by changing a decision.

Governance & risk

Security metrics

Which way does it send you?

Hand-drawn sketch: Out of reach on purpose. Whoever does it cannot be whoever approves it.

Governance & risk

Segregation of duties

Out of reach on purpose

Hand-drawn sketch: What actually takes the weight. Policy, standard, procedure and guideline are not four words for one thing.

Governance & risk

Standards

What actually takes the weight

Hand-drawn sketch: Three jobs, one machine. Doing the work, overseeing it and assuring it are not the same job.

Governance & risk

Three lines model

Three jobs, one machine

Frameworks & standards

CAPEC

The knot, not the rope

Hand-drawn sketch: Start at the bottom. The CIS safeguards come in an order, and the groups say where to begin.

Frameworks & standards

CIS Controls

Start at the bottom

Hand-drawn sketch: The drawing, or one house. CWE names the kind of weakness. A CVE names one instance in one product.

Frameworks & standards

CWE

The drawing, or one house

Frameworks & standards

Cyber Essentials

A five bar gate

Frameworks & standards

ISO 27001

Read the scope, not the certificate

Hand-drawn sketch: A field guide, not a battle plan. ATT&CK is a shared name for behaviour somebody has already watched happen.

Frameworks & standards

MITRE ATT&CK

A field guide, not a battle plan

Hand-drawn sketch: The Framework names the shelves. It says which outcomes must exist. It never says what to put on them.

Frameworks & standards

NIST CSF

The Framework names the shelves

Hand-drawn sketch: Change the number, get the parcel. An API hands out objects on request. Whose object is the question.

Frameworks & standards

OWASP API Top 10

Change the number, get the parcel

Hand-drawn sketch: The board at the trailhead. The Top 10 lists how people most often come unstuck. It is not a permit.

Frameworks & standards

OWASP Top 10

The board at the trailhead

Frameworks & standards

SSDF

The card names the loaf, not the oven

Hand-drawn sketch: Everybody is in the same water. A benchmark says how far you differ from the others. Nothing more.

Frameworks & standards

Benchmarking

Everybody is in the same water

Hand-drawn sketch: One extinguisher, four names. Catalogues describe much the same safeguards in different vocabularies.

Frameworks & standards

Control catalogues

One extinguisher, four names

Hand-drawn sketch: The gauge is on the gap. Maturity measures how regularly you do it, never how much risk it removes.

Frameworks & standards

Maturity models

The gauge is on the gap

Hand-drawn sketch: Four gates, whatever the method. Threat modelling methods differ. The four questions they ask do not.

Frameworks & standards

Threat modelling frameworks

Four gates, whatever the method

Hand-drawn sketch: Being inside stopped counting. Every request is judged on its own merits, wherever it comes from.

Frameworks & standards

Zero trust architecture

Being inside stopped counting

Hand-drawn sketch: A route round the back. QR codes hide their destination until you are already there and typically move the target onto a personal device outside corporate filtering.

Human factors & social engineering

QR phishing

A route round the back

Hand-drawn sketch: Borrowed authority skips the check. People comply more readily with requests that appear to come from authority.

Human factors & social engineering

Authority bias

Borrowed authority skips the check

Human factors & social engineering

Business email compromise

It attacks the process, not the machine

Human factors & social engineering

Consent phishing

You let it in, and it is still in

Hand-drawn sketch: Stop trusting the face. Synthetic voice and video have retired 'I recognised them' as verification.

Human factors & social engineering

Deepfakes

Stop trusting the face

Hand-drawn sketch: The other way in. Password and MFA reset processes are an authentication system of their own, usually a weaker one.

Human factors & social engineering

Help-desk social engineering

The other way in

Hand-drawn sketch: Use the number you already had. High-risk requests should be confirmed through a channel the requester did not choose, using contact details you already held.

Human factors & social engineering

Out-of-band verification

Use the number you already had

Human factors & social engineering

Phishing

One borrowed name, thousands of letters

Hand-drawn sketch: Shaped like your normal day. A believable story beats a clever exploit more often than the industry admits.

Human factors & social engineering

Pretexting

Shaped like your normal day

Hand-drawn sketch: Silence is the expensive part. Punitive responses to security mistakes buy silence, and silence is what turns a contained incident into one discovered late.

Human factors & social engineering

Reporting culture

Silence is the expensive part

Hand-drawn sketch: A net, not a lecture. No system should need every person to spot every attack every time.

Human factors & social engineering

Security awareness

A net, not a lecture

Hand-drawn sketch: The fortieth prompt. People asked to choose constantly eventually stop choosing carefully.

Human factors & social engineering

Security fatigue

The fortieth prompt

Hand-drawn sketch: Nothing was hacked. It was in shot. Secrets leak by being visible, and a video call is a window on the room.

Human factors & social engineering

Shoulder surfing

Nothing was hacked. It was in shot

Hand-drawn sketch: Baited with your own details. A few true facts turn a message you would bin into one you answer.

Human factors & social engineering

Spear phishing

Baited with your own details

Hand-drawn sketch: One beep, five people. Physical access control fails at the human interface, politely.

Human factors & social engineering

Tailgating

One beep, five people

Hand-drawn sketch: The detour that got closed. A deadline is cheap to invent and it buys the attacker your attention.

Human factors & social engineering

Urgency

The detour that got closed

Hand-drawn sketch: The path they actually take. The workaround, not the policy, is what is really governing you.

Human factors & social engineering

Usable security

The path they actually take

Hand-drawn sketch: Cut the wire first. Endpoint detection watches and reaches back, so it is a target in its own right.

Malware & ransomware

EDR

Cut the wire first

Hand-drawn sketch: Nothing runs unless it is on the list. The control is the list. Keeping it current is the whole of the job.

Malware & ransomware

Allowlisting

Nothing runs unless it is on the list

Hand-drawn sketch: Lashed to the deck. Backups protect you only if they survive the very event you kept them for.

Malware & ransomware

Backup isolation

Lashed to the deck

Hand-drawn sketch: Somebody else's hire fleet. A botnet is ordinary devices under one hand, rented out at scale.

Malware & ransomware

Botnets

Somebody else's hire fleet

Hand-drawn sketch: The wire under the wall. Every intrusion needs a way to talk back, and that traffic has to leave.

Malware & ransomware

Command and control

The wire under the wall

Hand-drawn sketch: Weigh what leaves. Exfiltration is its own stage, and it makes its own noise.

Malware & ransomware

Data exfiltration

Weigh what leaves

Hand-drawn sketch: The day nothing broke. A growing share of extortion never encrypts anything at all.

Malware & ransomware

Data theft extortion

The day nothing broke

Hand-drawn sketch: Cut the wire, not the power. Isolating a machine should keep it worth examining.

Malware & ransomware

Endpoint isolation

Cut the wire, not the power

Hand-drawn sketch: Held for thirty days. Backups that cannot be changed remove the attacker's easiest move.

Malware & ransomware

Immutable backups

Held for thirty days

Hand-drawn sketch: Borrowed, not brought. Attackers use the administrative tools already installed and already trusted.

Malware & ransomware

Living off the land

Borrowed, not brought

Malware & ransomware

Malware

The extra handle

Hand-drawn sketch: Pulled, not uprooted. Attackers invest early in a way back that survives the clean up.

Malware & ransomware

Persistence

Pulled, not uprooted

Hand-drawn sketch: One lever of four. The locked files are now only part of how the pressure is applied.

Malware & ransomware

Ransomware

One lever of four

Hand-drawn sketch: The answer comes from inside the room. A rootkit takes over the layer that reports on the system.

Malware & ransomware

Rootkits

The answer comes from inside the room

Hand-drawn sketch: It behaves, because it can tell. A sandbox limits reach. It cannot make the contents honest.

Malware & ransomware

Sandboxing

It behaves, because it can tell

Hand-drawn sketch: Three ways to travel. Virus, worm and Trojan are distinctions about movement.

Malware & ransomware

Viruses

Three ways to travel

Hand-drawn sketch: Rehearsing somebody else's moves. Emulation copies a known actor to test whether you would notice.

Threat actors & ATT&CK

Adversary emulation

Rehearsing somebody else's moves

Hand-drawn sketch: The line is for explaining. Real intrusions skip stages, double back and run in parallel.

Threat actors & ATT&CK

Attack chains

The line is for explaining

Hand-drawn sketch: The same person, now allowed. A credential converts an intrusion into ordinary access.

Threat actors & ATT&CK

Credential access

The same person, now allowed

Hand-drawn sketch: Priced out, not locked out. Attackers weigh effort against yield, like anyone else.

Threat actors & ATT&CK

Cybercrime economics

Priced out, not locked out

Hand-drawn sketch: One leaves nothing, the other leaves a hole. Adversaries either hide from a control or stop it working.

Threat actors & ATT&CK

Defence evasion

One leaves nothing, the other leaves a hole

Hand-drawn sketch: Made to be seen. Ideological actors optimise for attention, not for revenue.

Threat actors & ATT&CK

Hacktivism

Made to be seen

Hand-drawn sketch: Nothing taken, nothing working. Destruction, manipulation and disruption are objectives in their own right.

Threat actors & ATT&CK

Impact

Nothing taken, nothing working

Hand-drawn sketch: Only a few first holds. Every intrusion needs a first foothold, and the routes are few: phishing, exposed services, stolen credentials and trusted third parties.

Threat actors & ATT&CK

Initial access

Only a few first holds

Hand-drawn sketch: Someone else was already inside. Some criminals sell access rather than using it.

Threat actors & ATT&CK

Initial access brokers

Someone else was already inside

Hand-drawn sketch: One pass, three different people. Insider risk comes in three forms: malicious, negligent and compromised.

Threat actors & ATT&CK

Insider threat

One pass, three different people

Hand-drawn sketch: The one that waits. Some adversaries are resourced and patient in ways commercial crime is not, pursuing objectives where there is no payment to refuse.

Threat actors & ATT&CK

Nation-state operations

The one that waits

Hand-drawn sketch: Most of it is not about you. Most attacks look for anyone easy; a few look for you specifically.

Threat actors & ATT&CK

Opportunistic attacks

Most of it is not about you

Hand-drawn sketch: Steps nobody drew. Escalation is not always an exploit.

Threat actors & ATT&CK

Privilege escalation

Steps nobody drew

Hand-drawn sketch: Franchise, not gang. Ransomware operates as a service business: one group builds the platform, affiliates break in, proceeds are split.

Threat actors & ATT&CK

Ransomware-as-a-service

Franchise, not gang

Threat actors & ATT&CK

Threat actors

Three appetites, one thin cover

Hand-drawn sketch: The shelf is already full. Security budgets are argued for in the language of fear and settled in the language of trade-offs.

Security leadership & culture

Budgeting

The shelf is already full

Hand-drawn sketch: Saying yes is not sponsorship. Sponsorship that is not budget, arbitration authority and visible personal compliance is endorsement, which changes nothing.

Security leadership & culture

Executive sponsorship

Saying yes is not sponsorship

Hand-drawn sketch: How far away is the cord?. People report problems early only when reporting is safe.

Security leadership & culture

Psychological safety

How far away is the cord?

Hand-drawn sketch: One word, four numbers. Everyone in the room heard 'likely'. Nobody heard the same thing.

Security leadership & culture

Risk communication

One word, four numbers

Hand-drawn sketch: Weighing what did not happen. One side of the sum is money. The other side is an absence.

Security leadership & culture

Security ROI

Weighing what did not happen

Hand-drawn sketch: What falls past the tray. Sustained volume does not just tire people out. It lowers what they catch.

Security leadership & culture

Security burnout

What falls past the tray

Hand-drawn sketch: The path people actually take. The paved route is what you installed. The worn one is your culture.

Security leadership & culture

Security culture

The path people actually take

Hand-drawn sketch: What gets counted gets closed. Whether the risk actually fell is a different question.

Security leadership & culture

Security incentives

What gets counted gets closed

Hand-drawn sketch: Buy the gap closed. A roadmap made of tools is a procurement plan in disguise.

Security leadership & culture

Security roadmaps

Buy the gap closed

Hand-drawn sketch: Three people, all of that. A security team is nearly always smaller than the estate it covers.

Security leadership & culture

Security staffing

Three people, all of that

Security leadership & culture

Security theatre

Built like scenery

Hand-drawn sketch: A candle under the thermometer. When a measure becomes a target, it stops measuring what it did.

Metrics, decisions & economics

Goodhart's law

A candle under the thermometer

Hand-drawn sketch: The gauge decides what exists. Treating what cannot be measured as though it does not matter.

Metrics, decisions & economics

McNamara fallacy

The gauge decides what exists

Hand-drawn sketch: The mean sits well below the tail. Two days on average can still contain a breach found after nine months.

Metrics, decisions & economics

Averages

The mean sits well below the tail

Hand-drawn sketch: Rare breaks the arithmetic. A very accurate test on a very rare event still returns mostly false alarms.

Metrics, decisions & economics

Base rates

Rare breaks the arithmetic

Hand-drawn sketch: Only the top line got costed. The licence is the part of a control that is easy to write down.

Metrics, decisions & economics

Cost of controls

Only the top line got costed

Hand-drawn sketch: Four studies, one incident. Published costs disagree because nobody agrees what to count.

Metrics, decisions & economics

Cost of incidents

Four studies, one incident

Hand-drawn sketch: Draw the line before you read the dial. The same number decides nothing until somebody has said what it would change.

Metrics, decisions & economics

Decision thresholds

Draw the line before you read the dial

Hand-drawn sketch: Two decimal places, one shrug. Precision in the answer is not evidence about the inputs.

Metrics, decisions & economics

False precision

Two decimal places, one shrug

Metrics, decisions & economics

Leading indicators

Upstream and downstream

Hand-drawn sketch: A guess times a guess. Expected loss multiplies a frequency by a magnitude. Both are estimates.

Metrics, decisions & economics

Loss expectancy

A guess times a guess

Hand-drawn sketch: Rare is not never. Small probabilities get rounded to zero, and anything possible to likely.

Metrics, decisions & economics

Probability

Rare is not never

Hand-drawn sketch: The number stands on its guesses. Quantifying a risk makes the estimates underneath it arguable.

Metrics, decisions & economics

Risk quantification

The number stands on its guesses

Hand-drawn sketch: Graded from the pavement. External ratings score the one wall you show the internet.

Metrics, decisions & economics

Security scorecards

Graded from the pavement

Hand-drawn sketch: Two different not knowings. One of them can be looked up. The other only has a range.

Metrics, decisions & economics

Uncertainty

Two different not knowings

Hand-drawn sketch: The runbook does not apply. You often cannot isolate it, stop it or take it away.

OT, ICS & cyber-physical

OT incident response

The runbook does not apply

Hand-drawn sketch: The control can be the hazard. Here the process is physical, and safety comes first.

OT, ICS & cyber-physical

OT security

The control can be the hazard

Hand-drawn sketch: It obeys whoever gets there. A controller does what it is told by anything that can reach it.

OT, ICS & cyber-physical

PLC security

It obeys whoever gets there

OT, ICS & cyber-physical

SCADA

A word stretched past its meaning

Hand-drawn sketch: The bridge is carried by hand. Removable media is the ordinary way things cross an isolated boundary.

OT, ICS & cyber-physical

USB in OT

The bridge is carried by hand

Hand-drawn sketch: The roll call knocks it over. Finding out what is on an OT network can disturb what is on it.

OT, ICS & cyber-physical

Asset discovery in OT

The roll call knocks it over

Hand-drawn sketch: One cable, two deliveries. Connecting the plant to the business removes what the old model relied on.

OT, ICS & cyber-physical

Converged IT/OT

One cable, two deliveries

Hand-drawn sketch: The most powerful machine on the plant. The one that can rewrite the controllers also reads the post.

OT, ICS & cyber-physical

Engineering workstations

The most powerful machine on the plant

Hand-drawn sketch: The hatch in the wall. A historian is valuable because it touches both sides at once.

OT, ICS & cyber-physical

Historian servers

The hatch in the wall

OT, ICS & cyber-physical

Industrial protocols

It never asks who is speaking

Hand-drawn sketch: You cannot lift it out while it runs. Controllers outlive several generations of everything around them.

OT, ICS & cyber-physical

Legacy controllers

You cannot lift it out while it runs

Hand-drawn sketch: The patch that has to wait. Stopping production and voiding certification are both real costs.

OT, ICS & cyber-physical

Patching OT

The patch that has to wait

Hand-drawn sketch: The worst case is not the data. Here the consequence arrives as pressure, force and injury.

OT, ICS & cyber-physical

Physical process impact

The worst case is not the data

Hand-drawn sketch: The plank nobody took away. Vendor access is granted once, and reviewed almost never.

OT, ICS & cyber-physical

Remote vendor access

The plank nobody took away

Hand-drawn sketch: Never in front of the stop. A security control can create a hazard nobody costed.

OT, ICS & cyber-physical

Safety and security

Never in front of the stop

Hand-drawn sketch: Two systems, or one. A safety system works only while it shares nothing with the control system.

OT, ICS & cyber-physical

Safety systems

Two systems, or one

Hand-drawn sketch: The stairs and the holes. Layers separate enterprise from process. The question is what crosses.

OT, ICS & cyber-physical

Segmentation in OT

The stairs and the holes

Hand-drawn sketch: Nobody puts the lever back. A permission granted once stays granted until somebody removes it.

Everyday cyber & digital life

App permissions

Nobody puts the lever back

Hand-drawn sketch: Have you ever brought one back up?. A backup you have never restored is a belief, not a backup.

Everyday cyber & digital life

Backups

Have you ever brought one back up?

Hand-drawn sketch: It reads the page, and it holds the pen. An extension sits inside the browser with you. And it can be sold on.

Everyday cyber & digital life

Browser extensions

It reads the page, and it holds the pen

Hand-drawn sketch: One session, every hand. In a family the practical question is what the shared device stays signed in to.

Everyday cyber & digital life

Children's online safety

One session, every hand

Hand-drawn sketch: Encryption waits for the lock. Without a screen lock a device hands over its contents already open.

Everyday cyber & digital life

Device locks

Encryption waits for the lock

Hand-drawn sketch: The code goes to someone who is gone. Recovery is built to resist anyone who is not the account holder, including you.

Everyday cyber & digital life

Digital legacy

The code goes to someone who is gone

Hand-drawn sketch: Wiping the handset does not untie the string. What you lose is everything the device stayed signed in to.

Everyday cyber & digital life

Lost devices

Wiping the handset does not untie the string

Hand-drawn sketch: How you paid is what you can pull back. The payment method decides what recourse exists when nothing arrives.

Everyday cyber & digital life

Online shopping

How you paid is what you can pull back

Hand-drawn sketch: Someone set these before you arrived. Defaults are chosen by the service, in the interest of the service.

Everyday cyber & digital life

Privacy settings

Someone set these before you arrived

Hand-drawn sketch: It cannot read the post, it routes it. An untrusted network decides what you reach and what you are told about it.

Everyday cyber & digital life

Public Wi-Fi

It cannot read the post, it routes it

Hand-drawn sketch: Three narrowings, one chute. Fraud reuses its shape long after it has changed its story.

Everyday cyber & digital life

Scams

Three narrowings, one chute

Hand-drawn sketch: A computer with a use by date. Connected things stop being fixed long before they stop working.

Everyday cyber & digital life

Smart home devices

A computer with a use by date

Hand-drawn sketch: The answers are already posted. What you publish is raw material for whoever wants to be you.

Everyday cyber & digital life

Social media privacy

The answers are already posted

Hand-drawn sketch: The hole is published too. An update announces the weakness at the same moment it repairs it.

Everyday cyber & digital life

Software updates

The hole is published too

Hand-drawn sketch: A code can be carried. Anything you can read out is something somebody else can pass on.

Identity & access

'MFA stops phishing'

A code can be carried

Hand-drawn sketch: The threat is not in your kitchen. A written password and a reused password face different attackers.

Human factors & social engineering

'password sticky notes are always bad'

The threat is not in your kitchen

Hand-drawn sketch: The tunnel ends first. A VPN protects a stretch of path, and nothing at either end of it.

Networks

'VPN means secure'

The tunnel ends first

Hand-drawn sketch: The rail is the control. People slip. The design decides what that slip costs.

Human factors & social engineering

'humans are the weakest link'

The rail is the control

Hand-drawn sketch: Nobody looks like this. Attackers share a way in, not an appearance.

Threat actors & ATT&CK

'hackers always wear hoodies'

Nobody looks like this

Hand-drawn sketch: Certified, and propped open. A standard asks whether the control exists, not whether it works.

Governance & risk

'compliance means secure'

Certified, and propped open

Hand-drawn sketch: A finer mesh, not no mesh. macOS includes security controls, but Macs can still be affected by malware and security vulnerabilities.

Everyday cyber & digital life

'Macs do not get malware'

A finer mesh, not no mesh

Hand-drawn sketch: The wire stops. Air gaps remove ordinary network paths, but removable media, maintenance, supply chains and people can still bridge isolation.

Networks

'air gaps cannot be hacked'

The wire stops

Hand-drawn sketch: Something jumps the queue. CVSS Base severity is one input to remediation.

Vulnerability management

'a high CVSS means patch first'

Something jumps the queue

Hand-drawn sketch: The label, not the glass. Open source is not inherently less secure.

Supply chain & third parties

'open source is less secure'

The label, not the glass

Identity & access

Session lifetime is a security decision

Somebody chose how long it burns

Identity & access

Step-up authentication protects sensitive moments

The arm only comes down once

Identity & access

Machine identities need owners too

Whose is this one? Machine identities are somebody's responsibility, or nobody's

Identity & access

Password length beats decorative complexity

Add wheels, not squiggles

Identity & access

Forced rotation can create predictable passwords

Only one character moves

Identity & access

Salts make identical passwords look different

One grain each

Hand-drawn sketch: Every copy needs its own guard. A secret that has been copied about is not one secret. It is four.

Identity & access

Every secret copy creates another secret to protect

Every copy needs its own guard

Hand-drawn sketch: The deletion is just another commit. Taking a secret out of the file does not take it out of the history.

Identity & access

Secrets in source control have a long memory

The deletion is just another commit

Hand-drawn sketch: A label on the outside of the bag. Anything that can see the process can read what was handed to it.

Identity & access

Environment variables are not secret vaults

A label on the outside of the bag

Hand-drawn sketch: Same theft, different window. How long a stolen credential keeps working is decided long before it is stolen.

Identity & access

Temporary credentials shrink the theft window

Same theft, different window

Hand-drawn sketch: The alarm does not take it back. Detection is where the work starts, not where it finishes.

Identity & access

Secret scanning finds exposure, not erasure

The alarm does not take it back

Hand-drawn sketch: Nobody hands the old one back. Every move adds access. Almost nothing takes it away.

Identity & access

Least privilege decays over time

Nobody hands the old one back

Hand-drawn sketch: Loud on purpose. Break glass access should be hard to reach for, and impossible to use quietly.

Identity & access

Break-glass access should be exceptional and noisy

Loud on purpose

Hand-drawn sketch: Read the account, not the business card. Seniority describes a person. Reach describes an account. Only one of them is a boundary.

Identity & access

Privilege boundaries matter more than job titles

Read the account, not the business card

Hand-drawn sketch: Granted upstairs, arrives downstairs. Inherited permission is real permission, even where nobody granted it.

Identity & access

Permission inheritance can hide excessive access

Granted upstairs, arrives downstairs

Hand-drawn sketch: One character, a much bigger circle. A wildcard grants everything that matches, including things nobody has made yet.

Identity & access

Wildcard permissions widen blast radius

One character, a much bigger circle

Hand-drawn sketch: One no ends it. However many policies say yes, a single explicit deny settles the question.

Identity & access

Deny rules can create hard guardrails

One no ends it

Hand-drawn sketch: The hand is not on the system. Administration tooling carries the same authority as the administrator.

Identity & access

Admin tools are part of the privileged access path

The hand is not on the system

Hand-drawn sketch: You only met link one. Authority passed onward keeps going. The chain does not stop where you agreed.

Identity & access

Delegation creates chains of trust

You only met link one

Hand-drawn sketch: Approving what you cannot read. A reviewer needs to know what an entitlement lets somebody actually do.

Identity & access

Entitlement reviews need business context

Approving what you cannot read

Hand-drawn sketch: The ticket, not the person. Consent delegates access. Proving who turned up is a separate question.

Identity & access

OAuth consent is not proof of identity

The ticket, not the person

Hand-drawn sketch: It only presses three. The panel is unchanged. The scope decides how much of it a token can reach.

Identity & access

Token scope defines capability

It only presses three

Hand-drawn sketch: Whoever picks it up. A bearer token carries no name. Possession is the whole of the authorisation.

Identity & access

Bearer tokens behave like cash

Whoever picks it up

Hand-drawn sketch: One handle, every gate. Single sign on gathers the convenience and the consequence into one place.

Identity & access

SSO concentrates convenience and consequence

One handle, every gate

Hand-drawn sketch: The decision moved house. Relying on an identity provider relocates the trust. It does not remove it.

Identity & access

Federation shifts where trust lives

The decision moved house

Hand-drawn sketch: Posted only where it fits. An exact match against a registered address decides where the code is sent.

Identity & access

Redirect URI validation protects token delivery

Posted only where it fits

Identity & access

Token audience prevents universal reuse

A ticket for this gate only

Identity & access

Token revocation is harder than password change

Changing it is easy

Identity & access

Workload federation can remove stored cloud keys

Ask for it, do not keep it

Email & browser security

DKIM protects signed content against later modification

Change one word, break the seal

Email & browser security

DMARC depends on alignment

Both names, or neither

Email & browser security

Forwarding can break email authentication assumptions

It was re-posted on the way

Email & browser security

A display name is not an email address

They wrote that name themselves

Email & browser security

Reply-chain hijacking borrows existing trust

Trust borrowed from the thread

Email & browser security

Secure email gateways see only traffic that reaches them

It only sees what comes past it

Email & browser security

Quarantine creates a second security decision

Held is not decided

Hand-drawn sketch: The postmark, not the message. SPF, DKIM and DMARC prove who posted it. They never read a word inside.

Email & browser security

Authenticated email can still be malicious

The postmark, not the message

Hand-drawn sketch: A quiet second sorter. A single inbox rule can hide the warnings and keep working for months.

Email & browser security

Mailbox rules can become persistence

A quiet second sorter

Hand-drawn sketch: It only answers where. DNS turns a name into an address. Nothing in it says the address is safe.

Networks

DNS is a directory, not proof of safety

It only answers where

Hand-drawn sketch: A sealed postcard. DNSSEC proves the answer is genuine. It never puts it in an envelope.

Networks

DNSSEC signs answers but does not hide them

A sealed postcard

Hand-drawn sketch: Covered to the desk, open to the door. DNS over HTTPS protects the lookup in transit. It does not protect the journey.

Networks

Encrypted DNS protects the resolver path, not the destination

Covered to the desk, open to the door

Hand-drawn sketch: It all hangs from one fitting. Control of the domain name sits above everything you hardened on the servers.

Networks

Registrar compromise can outrank server security

It all hangs from one fitting

Hand-drawn sketch: The pin that makes them stop. Registrar locks do not prevent a transfer. They buy you delay and a warning.

Networks

Registrar locks add friction to domain theft

The pin that makes them stop

Hand-drawn sketch: Your plate, their locker. You gave up the resource. The record still sends people to whoever holds it now.

Networks

Dangling DNS can point to somebody else's resource

Your plate, their locker

Hand-drawn sketch: Nobody minding the stall. A subdomain is taken over because it was left unclaimed, not because it was broken into.

Networks

Subdomain takeover begins with abandoned ownership

Nobody minding the stall

Hand-drawn sketch: Two maps of the same building. Split horizon DNS answers the same name differently depending on who asks.

Networks

Split-horizon DNS gives different users different maps

Two maps of the same building

Hand-drawn sketch: The name names its signers. CAA lets a domain publish the short list of authorities allowed to issue for it.

Networks

CAA narrows who may issue certificates

The name names its signers

Hand-drawn sketch: Every certificate leaves a receipt. Public logs make issuance something anyone can go and look at.

Networks

Certificate transparency makes issuance observable

Every certificate leaves a receipt

Hand-drawn sketch: A claim, not a proof. A routing announcement says I can reach this. Nothing in it says I should.

Networks

BGP announces reachability, not truth

A claim, not a proof

Hand-drawn sketch: The points move under the train. A hijacked route changes the path while the address stays exactly right.

Networks

BGP hijacking can redirect traffic before applications see it

The points move under the train

Hand-drawn sketch: The whole motorway down a side lane. A route leak is usually an honest mistake, and it still takes things down.

Networks

Route leaks can be accidental and disruptive

The whole motorway down a side lane

Hand-drawn sketch: Only the first pair of hands is signed for. RPKI can prove who may start a route. It cannot prove the path it then took.

Networks

RPKI validates route origins, not the whole path

Only the first pair of hands is signed for

Hand-drawn sketch: The narrower claim takes it. When two routes cover the same address, the more specific one wins.

Networks

More specific Internet routes usually win

The narrower claim takes it

Hand-drawn sketch: One address, many doorsteps. Anycast lets the same address be answered from many places at once.

Networks

Anycast sends one address to multiple places

One address, many doorsteps

Hand-drawn sketch: We all drink from the same main. Filtering what you accept from a neighbour is the baseline, not a favour.

Networks

Route filtering is Internet hygiene

We all drink from the same main

Hand-drawn sketch: Same two ends, different wires. The path your traffic takes can change overnight while nothing you run changes.

Networks

Internet paths can change without applications changing

Same two ends, different wires

Hand-drawn sketch: The train is fine. The points moved. Routing decides the road. The traffic never questions it.

Networks

Control-plane attacks can break data-plane assumptions

The train is fine. The points moved

Hand-drawn sketch: A sealed pipe to a stranger. TLS protects what travels. It says nothing about who is waiting.

Networks

TLS encrypts a connection, not endpoint intentions

A sealed pipe to a stranger

Hand-drawn sketch: Held together by a chain of seals. A name and a key, tied, and vouched for all the way to an anchor.

Networks

Certificates bind keys to names through trust chains

Held together by a chain of seals

Hand-drawn sketch: Every one of them runs out. Certificates end on their own schedule, and never on yours.

Networks

Certificate expiry creates operational pressure

Every one of them runs out

Hand-drawn sketch: The certificate is fine. An in date certificate puts no limit at all on a stolen private key.

Networks

Private-key compromise survives a valid certificate

The certificate is fine

Hand-drawn sketch: The turning that stops existing. HSTS deletes the insecure way in. Preload deletes it before you arrive.

Networks

HSTS removes the insecure choice after a browser has learned the policy, while preload can protect the first visit too

The turning that stops existing

Hand-drawn sketch: The proof comes stapled on. The server fetches the freshness check, so your browser need not.

Networks

OCSP stapling moves status evidence closer

The proof comes stapled on

Hand-drawn sketch: Both of you show papers. Ordinary TLS proves the server. Mutual TLS proves the caller as well.

Networks

Mutual TLS authenticates both ends

Both of you show papers

Hand-drawn sketch: The seal ends here, not there. Whoever decrypts the traffic has just joined the trusted inside.

Networks

TLS termination moves the trust boundary

The seal ends here, not there

Hand-drawn sketch: A slot cut for one shape. Pinning refuses everything you did not name, your own new one included.

Networks

Certificate pinning trades flexibility for tighter expectations

A slot cut for one shape

Hand-drawn sketch: The maths was never the problem. Public key infrastructure falls over on dates, renewals and publication, not on broken ciphers.

Networks

PKI can fail operationally while cryptography is sound

The maths was never the problem

Hand-drawn sketch: Their note, your session. Cross site request forgery relies on the browser attaching your login to somebody else's request.

Application security

CSRF abuses an authenticated browser

Their note, your session

Hand-drawn sketch: It comes out in your own voice. Cross site scripting runs somebody else's script inside a page the visitor has no reason to doubt.

Application security

XSS turns trusted pages into script delivery

It comes out in your own voice

Hand-drawn sketch: The plug has to match the socket. The right escaping depends entirely on where the value is being written.

Application security

Output encoding is context-specific

The plug has to match the socket

Hand-drawn sketch: Two dots at a time. Path traversal walks a request out of the directory the application intended to serve.

Application security

Path traversal escapes the intended file area

Two dots at a time

Hand-drawn sketch: The label is a claim, not a check. Upload safety is about what the file is, where it lands and what is able to run it.

Application security

File upload security is more than extension checking

The label is a claim, not a check

Hand-drawn sketch: Your livery, their destination. An open redirect lets a stranger choose where a link on your own domain finishes.

Application security

Open redirects lend trusted domains to phishing

Your livery, their destination

Hand-drawn sketch: Instructions the browser follows. Security headers are how a server changes what a browser will do with its page.

Application security

Security headers shape browser behaviour

Instructions the browser follows

Hand-drawn sketch: Every line says the same name. A shared API key proves a call was allowed. It never says who made it.

API security

Shared API keys give coarse identity

Every line says the same name

Hand-drawn sketch: It counts, it never looks up. A rate limit protects a finite resource. It was never an identity check.

API security

Rate limits are resource controls, not identity controls

It counts, it never looks up

Hand-drawn sketch: The old panel is still standing. A new version sits beside the old one. It does not replace it.

API security

Old API versions can preserve old weaknesses

The old panel is still standing

Hand-drawn sketch: A shape, not a list of bad words. A schema states what may come in. The rest is never interpreted.

API security

Schema validation narrows what an API interprets

A shape, not a list of bad words

Hand-drawn sketch: A postcard that asks for a forest. Nesting multiplies. The bill lands on the server, not the sender.

API security

GraphQL depth can become a resource attack

A postcard that asks for a forest

Hand-drawn sketch: The words are easy to copy. Anyone can post to your webhook address. Only one can leave the mark.

API security

Webhook signatures authenticate provider messages

The words are easy to copy

Hand-drawn sketch: Three attempts, one parcel. A retry should ask again. It should never buy again.

API security

Idempotency prevents retries becoming duplicates

Three attempts, one parcel

Hand-drawn sketch: Same room, different desks. One browser holds both pages. Neither of them may read the other.

Email & browser security

Same-origin policy limits which pages can read each other

Same room, different desks

Hand-drawn sketch: A propped hatch, not a checkpoint. The wall relaxes what may be read. It still asks nobody for a name.

Email & browser security

CORS relaxes browser reading rules, not authentication

A propped hatch, not a checkpoint

Hand-drawn sketch: Some journeys, not every journey. SameSite decides when your cookie comes along for the ride.

Email & browser security

SameSite cookies reduce some cross-site request risks

Some journeys, not every journey

Hand-drawn sketch: Everything passes under it. An extension sits between you and every page you will ever open.

Email & browser security

Browser extensions inherit powerful visibility

Everything passes under it

Hand-drawn sketch: Open shelves by the door. Local storage is a handy shelf. It was never a strongroom.

Email & browser security

Local storage is convenient, not a secure vault

Open shelves by the door

Hand-drawn sketch: Only from the addresses you wrote down. Content Security Policy tells the browser which script sources may run.

Email & browser security

Content Security Policy constrains script sources

Only from the addresses you wrote down

Hand-drawn sketch: Pressed here. Answered there. Clickjacking lays a harmless page over the control you really operate.

Email & browser security

Clickjacking hides the real control beneath the click

Pressed here. Answered there

Hand-drawn sketch: Your eyes are not the thing comparing. Autofill decides by the exact address, not by how the page looks.

Email & browser security

Autofill changes the phishing surface

Your eyes are not the thing comparing

Hand-drawn sketch: A gate with no fence. Browser side checks run on the sender's own machine, so they can be walked around.

Email & browser security

Client-side validation is not a security boundary

A gate with no fence

Hand-drawn sketch: All three, or it is somewhere else. An origin is the scheme, the host and the port taken together.

Email & browser security

Origin means scheme, host and port together

All three, or it is somewhere else

Hand-drawn sketch: Stop posting copies. Hand out passes. A role issues a short lived credential on request, so nothing permanent gets shared.

Identity & access

Cloud roles can replace copied long-lived keys

Stop posting copies. Hand out passes

Hand-drawn sketch: The thing has a policy too. A resource policy is attached to the resource, so it grants on its own.

Identity & access

Resource policies create a second authorisation surface

The thing has a policy too

Hand-drawn sketch: Grant what you like. It stops at the rail. A permission boundary is the ceiling on anything a delegated role can hold.

Identity & access

Permission boundaries cap delegated power

Grant what you like. It stops at the rail

Hand-drawn sketch: The wrong setting is not on the dial. Organisation guardrails take the dangerous choice away from every account below.

Identity & access

Organisation guardrails prevent dangerous local choices

The wrong setting is not on the dial

Hand-drawn sketch: Your perimeter now runs round their office. Cross account trust lets identities from somewhere else act inside your account.

Identity & access

Cross-account trust expands the identity perimeter

Your perimeter now runs round their office

Hand-drawn sketch: Two doors, one room. Human sign in and machine sign in arrive by completely different routes.

Identity & access

Console access and workload access are different paths

Two doors, one room

Hand-drawn sketch: Still wired. A permission you never use is a path that still opens.

Identity & access

Unused cloud permissions are latent attack paths

Still wired

Hand-drawn sketch: Stamped on the way through. Conditions attach the circumstances to a permission, not just the verb.

Identity & access

IAM conditions add context to permissions

Stamped on the way through

Hand-drawn sketch: A ceiling, never a floor. Organisation policy can take permissions away. It cannot add one.

Identity & access

Organisation guardrails limit access but do not grant it

A ceiling, never a floor

Hand-drawn sketch: Two towns, one mains. Separate regions still sit on top of a single provider.

Cloud security

Multi-region is not the same as multi-provider

Two towns, one mains

Hand-drawn sketch: It copied the mistake. Scaling reproduces whatever you handed it, faults included.

Cloud security

Autoscaling can scale a failure too

It copied the mistake

Hand-drawn sketch: The van takes the machines. A managed service carries off the work, not the consequences.

Cloud security

Managed services move responsibility, not all risk

The van takes the machines

Hand-drawn sketch: Nobody asks twice. Network position is not a reason to trust anything.

Cloud security

Private networking does not automatically mean trusted

Nobody asks twice

Hand-drawn sketch: Watch the loading bay. A boundary that only inspects arrivals is half a boundary.

Cloud security

Egress is part of the cloud security boundary

Watch the loading bay

Hand-drawn sketch: The copy keeps nothing. A snapshot duplicates the data and leaves the controls behind.

Cloud security

Snapshots can copy sensitive data silently

The copy keeps nothing

Hand-drawn sketch: The box went, the openings stayed. Serverless takes away the server, not the ways in.

Cloud security

Serverless still has an attack surface

The box went, the openings stayed

Hand-drawn sketch: One chipped stamp. Infrastructure as code copies your errors as faithfully as your intentions.

Cloud security

Infrastructure as code makes mistakes reproducible

One chipped stamp

Hand-drawn sketch: The train runs, the levers are dead. Control plane failure deserves a test of its own.

Cloud security

Resilience tests should include control-plane failure

The train runs, the levers are dead

Hand-drawn sketch: Partitions, not buildings. Containers share one kernel. A virtual machine brings its own.

Containers & Kubernetes

A container is isolation, not a tiny virtual machine

Partitions, not buildings

Hand-drawn sketch: Checked at the hatch, not inside the room. Kubernetes RBAC governs API actions, not behaviour at runtime.

Containers & Kubernetes

Kubernetes RBAC controls API actions, not what a running container can then do

Checked at the hatch, not inside the room

Hand-drawn sketch: A badge on the same rail. A pod service account is a workload identity, with a token to match.

Containers & Kubernetes

A pod service account is an identity

A badge on the same rail

Hand-drawn sketch: Hinges, but no gate. A network policy does nothing at all unless something enforces it.

Containers & Kubernetes

NetworkPolicy needs an enforcement engine

Hinges, but no gate

Hand-drawn sketch: Stopped on the chute. Admission control turns risky objects away before anything runs.

Containers & Kubernetes

Admission control can stop risky objects before they run

Stopped on the chute

Hand-drawn sketch: The floor is the boundary. Privileged takes away the thing that was keeping the container off the host.

Containers & Kubernetes

Privileged containers weaken the host boundary

The floor is the boundary

Hand-drawn sketch: Same ticket, different coat. A mutable tag can point at new contents without anyone asking you.

Containers & Kubernetes

Mutable image tags can move underneath you

Same ticket, different coat

Containers & Kubernetes

Cluster admin has a very large blast radius

One lever, every room

Software supply chain & DevSecOps

A trusted build can faithfully ship malicious source

The oven never reads the recipe

Software supply chain & DevSecOps

Dependency confusion exploits naming and resolution

Same name, wrong shelf

Software supply chain & DevSecOps

Typosquatting attacks developer attention

The eye test you take at 2am

Software supply chain & DevSecOps

Lockfiles improve repeatability, not eternal safety

Always the same tin

Software supply chain & DevSecOps

Transitive dependencies enlarge unseen trust

One handshake, a hundred guests

Software supply chain & DevSecOps

Maintainer compromise can use the normal release channel

It came by the usual van

Software supply chain & DevSecOps

Build secrets should not become build artefacts

Deleted on top, still underneath

Software supply chain & DevSecOps

Reproducible builds make unexpected differences visible

Level, or it is telling you something

Software supply chain & DevSecOps

A deployment pipeline is a privileged production path

It goes straight over the gate

Hand-drawn sketch: Nobody looked inside the machine. Review covers the source. The build environment does the work.

Software supply chain & DevSecOps

Code review does not protect a compromised runner

Nobody looked inside the machine

Hand-drawn sketch: The belt does not ask who sent it. A pull request from a fork is code written by someone you have not met.

Software supply chain & DevSecOps

Forked code should not automatically receive secrets

The belt does not ask who sent it

Hand-drawn sketch: The gate only guards its own road. Protected main is one way in. Count the others.

Software supply chain & DevSecOps

Branch protection does not protect every release path

The gate only guards its own road

Hand-drawn sketch: One bolt across all three. A deploy identity is only as narrow as the places it can actually reach.

Software supply chain & DevSecOps

Deployment credentials should match deployment scope

One bolt across all three

Hand-drawn sketch: The log is a page, and people read pages. Whatever the build echoes, it echoes where the whole team can see it.

Software supply chain & DevSecOps

Build logs can become secret leaks

The log is a page, and people read pages

Hand-drawn sketch: You gave the job a desk indoors. A self hosted runner sits inside the trust your office already grants.

Software supply chain & DevSecOps

Self-hosted runners inherit local trust

You gave the job a desk indoors

Hand-drawn sketch: The seal is only as good as the stamp. Signing proves custody of a key, and nothing more than that.

Software supply chain & DevSecOps

Release signing depends on protecting signing keys

The seal is only as good as the stamp

Hand-drawn sketch: Every step gets a hand on the lever. A build action is somebody else's code running with your build's privileges.

Software supply chain & DevSecOps

Pipeline dependencies are code-execution dependencies

Every step gets a hand on the lever

Hand-drawn sketch: Two levers, one machine. Going back changes production exactly as much as going forward.

Software supply chain & DevSecOps

Rollback needs the same security as rollout

Two levers, one machine

Hand-drawn sketch: Three instruments, three answers. Evidence, likelihood and a decision are not the same reading.

Vulnerability management

KEV, EPSS and SSVC turn exploitation evidence and likelihood into different prioritisation signals

Three instruments, three answers

Hand-drawn sketch: The tin is not the wall. A released patch and a repaired machine are two different events.

Vulnerability management

Patch available does not mean patch deployed

The tin is not the wall

Hand-drawn sketch: The scan stops where the list stops. Your inventory sets the edge of anything a scan can tell you.

Vulnerability management

Asset inventory bounds vulnerability truth

The scan stops where the list stops

Hand-drawn sketch: Same flaw, no way across. A compensating control changes reachability, not severity.

Vulnerability management

Compensating controls can change exploitability

Same flaw, no way across

Hand-drawn sketch: Somebody sets the angle. Choosing when to patch is choosing how much exposure to accept.

Vulnerability management

Patch windows are risk decisions

Somebody sets the angle

Hand-drawn sketch: The spares drawer is empty. When support ends, the only remaining fix is a different thing.

Vulnerability management

End-of-life software turns patching into replacement

The spares drawer is empty

Hand-drawn sketch: The ticket closed. The port did not. Closure is a claim until something checks the asset again.

Vulnerability management

Vulnerability closure needs verification

The ticket closed. The port did not

Hand-drawn sketch: Counted three. Answering six. The outside view is the one that decides your exposure.

Vulnerability management

The Internet sees what you expose, not what your CMDB remembers

Counted three. Answering six

Hand-drawn sketch: The fence just got longer. A name that resolves is a boundary you now have to hold.

Vulnerability management

A new subdomain can create a new perimeter

The fence just got longer

Hand-drawn sketch: Doors around the back. Every tool bought around the process still carries your data.

Vulnerability management

Shadow IT becomes shadow attack surface

Doors around the back

Hand-drawn sketch: The wire arrives first. Networks merge on day one. Inventories merge a quarter later.

Vulnerability management

Acquisitions merge attack surfaces before inventories

The wire arrives first

Vulnerability management

Internet exposure is a property that changes

The tide does not read your map

Vulnerability management

A forgotten test system can be a production entry point

The shed is still joined to the house

Vulnerability management

Third-party hosted assets still carry your name

Their building, your name over the door

Vulnerability management

Attack surface reduction removes paths instead of adding alerts

A bell on the door, or no door

Vulnerability management

IPv6 can create exposure beside an IPv4 mental model

Two ways through, one on the plan

Vulnerability management

Exposure without ownership stays exposed longer

The one with a name on it gets fixed

Malware & ransomware

Ransomware is often the last stage, not the first

The bang is the end of the fuse

Malware & ransomware

Backups are ransomware targets

The lifeboat goes first

Malware & ransomware

Lateral movement turns one foothold into many

Along the loft, house to house

Malware & ransomware

Command and control gives malware an operator

Somebody is still holding the controller

Hand-drawn sketch: Still there after the tide. Persistence is a foothold built to outlast reboots, resets and rebuilds.

Malware & ransomware

Persistence is about surviving change

Still there after the tide

Hand-drawn sketch: They use your tools, not theirs. Living off the land removes the moment when something new shows up.

Malware & ransomware

Living off the land reduces new-tool visibility

They use your tools, not theirs

Hand-drawn sketch: The data is the easy half. After ransomware you also have to rebuild every identity you can no longer trust.

Malware & ransomware

Ransomware recovery is an identity problem too

The data is the easy half

Hand-drawn sketch: The clock only times the locking. How fast the files were encrypted is the smallest part of the harm.

Malware & ransomware

Encryption speed is not the only ransomware impact

The clock only times the locking

Hand-drawn sketch: Silence is not the same as safety. Endpoint detection only ever shows you what a living sensor still reports.

Vulnerability management

EDR visibility depends on the sensor being alive

Silence is not the same as safety

Hand-drawn sketch: The list checks the name. Allowlisting controls execution. It never judges intent.

Vulnerability management

Application allowlisting controls execution, not intent

The list checks the name

Hand-drawn sketch: One click, two blast radii. Local admin does not change the odds. It changes the consequence.

Vulnerability management

Local admin changes the consequence of compromise

One click, two blast radii

Hand-drawn sketch: A tick is a photograph. Device compliance describes the machine at the instant it was checked.

Vulnerability management

Device compliance is a snapshot, not permanent health

A tick is a photograph

Hand-drawn sketch: At rest means switched off. A device that is running has already unlocked itself.

Vulnerability management

Full-disk encryption protects a powered-off device best

At rest means switched off

Hand-drawn sketch: Design the socket, not the poster. Removable media controls are a property of the system, not an instruction to staff.

Vulnerability management

USB controls are a system design problem

Design the socket, not the poster

Vulnerability management

Patch compliance percentages can hide critical exceptions

What the number covers

Vulnerability management

Endpoint isolation buys investigation time

Cut the wire, keep the power

Vulnerability management

Reimaging removes software, not stolen credentials

A new machine, the same pass

Vulnerability management

Security agents can become privileged attack surfaces

The tool that reaches everything

Networks

Segmentation limits paths, not compromise itself

Bulkheads, not armour

Networks

Every firewall allow rule creates a permitted path

Every rule is a hole

Networks

Flat networks turn local trust into broad reachability

One floor, no walls

Networks

Microsegmentation moves boundaries closer to workloads

Move the fence inwards

Networks

Management paths can bypass segmentation

Over the checkpoint

Networks

Default deny makes new paths deliberate

Nothing moves until a lever is pulled

Networks

Network zones should reflect trust and function

Zones follow the job

Networks

Segmentation needs tested failure behaviour

Pull the plug and watch

Networks

Encrypted traffic still needs network policy

Sealed, and still checked

Identity & access

Zero trust removes implicit trust in network position, not confidence in colleagues

It was never about the people

Identity & access

Continuous evaluation means decisions can change

Yes is not for ever

Identity & access

Policy enforcement depends on reliable identity signals

Right rule, smudged label

Identity & access

Zero trust does not remove network controls

Keep the fence

Identity & access

Service-to-service traffic needs identity too

Machines need names too

Identity & access

Device trust should match what is actually measured

Only what the probe touched

Identity & access

Policy engines create critical dependencies

One box, every door

Hand-drawn sketch: Lift the floor. You set out to move one service, and the wiring comes up with it.

Identity & access

Zero trust migration is dependency discovery

Lift the floor

Hand-drawn sketch: The shadow, not the thing. Every log entry is one sensor's view, in the only words it had.

Detection & SOC

A log records an observation, not objective truth

The shadow, not the thing

Hand-drawn sketch: It left before you got there. Central collection makes wiping the local log a much smaller win.

Detection & SOC

Central logging reduces local erasure risk

It left before you got there

Hand-drawn sketch: Everything, including that. Turn the detail all the way up and the secrets go in with the rest.

Detection & SOC

Verbose logging can leak secrets

Everything, including that

Hand-drawn sketch: The line only goes back so far. How far back you can investigate was settled when someone chose a number.

Detection & SOC

Retention determines how far back you can investigate

The line only goes back so far

Hand-drawn sketch: Point it at the question. Decide what you must be able to answer, then go and collect that.

Detection & SOC

Telemetry coverage should map to detection questions

Point it at the question

Hand-drawn sketch: Silence is not the same as clear. When the log changes shape, the detection stops matching and says nothing.

Detection & SOC

Parsing errors can silently break detections

Silence is not the same as clear

Hand-drawn sketch: Buried by the ordinary. The line that mattered arrived with ten million that did not.

Detection & SOC

High-volume logs can hide high-value events

Buried by the ordinary

Hand-drawn sketch: In only. An audit log has to survive the people it is watching.

Detection & SOC

Audit logs need protected access

In only

Hand-drawn sketch: A guess you can run. Every detection starts as somebody's theory about what an attacker would do.

Detection & SOC

A detection is a hypothesis encoded as logic

A guess you can run

Hand-drawn sketch: One screen, one setting. Catching everything and catching only what matters pull opposite ways.

Detection & SOC

High fidelity and high coverage pull in different directions

One screen, one setting

Hand-drawn sketch: The hole is copied too. A detection can only ever see what its data source recorded.

Detection & SOC

Detections inherit telemetry blind spots

The hole is copied too

Hand-drawn sketch: Name the behaviour. The name is the first thing a responder reads, and often the only thing.

Detection & SOC

Detection names should describe behaviour, not certainty

Name the behaviour

Hand-drawn sketch: The tag on the switch. Muting an alert accepts a risk on behalf of everybody else.

Detection & SOC

Suppression is a security decision

The tag on the switch

Hand-drawn sketch: Run the old cases again. An edit can stop a detection firing without anybody noticing.

Detection & SOC

Detection rules need regression tests

Run the old cases again

Hand-drawn sketch: The footprints, not the coat. An adversary swaps tooling far more easily than they change how they work.

Detection & SOC

Behaviour often outlives static indicators

The footprints, not the coat

Hand-drawn sketch: Three weak bearings. Not one of them is worth waking anybody for on its own.

Detection & SOC

Weak signals can correlate into a strong case

Three weak bearings

Hand-drawn sketch: Planting is not the job. A rule nobody returns to quietly stops being a detection.

Detection & SOC

Detection ownership includes maintenance

Planting is not the job

Hand-drawn sketch: The first stone. An alert with no next step is only a note that something happened.

Detection & SOC

Every alert should have an investigative next step

The first stone

Hand-drawn sketch: Bring a question. A dashboard can only show what somebody already decided to chart.

Detection & SOC

Hunting starts with a question, not a dashboard

Bring a question

Detection & SOC

Absence of evidence depends on coverage

Only the lit part was searched

Detection & SOC

Hunts can become future detections

Leave a bell on the path

Hand-drawn sketch: Did it move the points? Intelligence is useful when it changes what you ask or what you do. Threat intelligence should change a question or action.

Detection & SOC

Threat intelligence should change a question or action

Did it move the points? Intelligence is useful when it changes what you ask or what you do

Detection & SOC

Entity context turns events into investigations

Thread the beads

Detection & SOC

Baseline means understanding normal variation

Normal is a band, not a line

Detection & SOC

Hunt scope should be explicit

Peg out the ground first

Detection & SOC

A wrong hypothesis can still be useful

The hole still tells you something

Detection & SOC

Hunts need stopping criteria

A knot at the end of the line

Incident response

Incident severity can change as facts emerge

The needle moves as facts land

Incident response

A timeline should separate observation from inference

Two rows, not one

Hand-drawn sketch: While someone still holds the pen. Rotation does not stick until the access that can restore it is taken back.

Incident response

Credential reset order matters

While someone still holds the pen

Hand-drawn sketch: A clean glass, the same pipe. A rebuild inherits whatever it is restored onto.

Incident response

Recovery needs clean dependencies

A clean glass, the same pipe

Hand-drawn sketch: One hand on the switch. Named roles stop two people making opposite calls in the same minute.

Incident response

Incident roles reduce decision collisions

One hand on the switch

Hand-drawn sketch: The clock starts before the answers. Statutory reporting runs from when you became aware, not from when you were sure.

Incident response

Reporting clocks can start before certainty

The clock starts before the answers

Hand-drawn sketch: Nobody fixed the leak. An action aimed at a person leaves the condition exactly as it was.

Incident response

Post-incident actions should fix systems, not just people

Nobody fixed the leak

Hand-drawn sketch: Mark the copy, never the original. Examining something leaves traces on it, so the examining happens on a duplicate.

Incident response

Forensic copies protect original evidence

Mark the copy, never the original

Hand-drawn sketch: The same short string, twice. A hash is computed at seizure and again whenever the copy is used.

Incident response

Hashes can show evidence stayed unchanged

The same short string, twice

Hand-drawn sketch: One moment, three different times. Every clock and every field writes the same instant down its own way.

Incident response

Timestamps need interpretation

One moment, three different times

Hand-drawn sketch: It has to unwrap itself to run. What is unreadable on the disk is often plain in memory.

Incident response

Memory can reveal what disk cannot

It has to unwrap itself to run

Hand-drawn sketch: You leave prints of your own. Reading a live system changes it. What matters is that you can account for the change.

Incident response

Forensic tooling can change the thing examined

You leave prints of your own

Hand-drawn sketch: The card, not the book. Deleting usually removes the listing. The pages stay on the shelf.

Incident response

Deleted does not always mean gone

The card, not the book

Hand-drawn sketch: You get what comes through the hatch. In the cloud, the evidence you can have is the evidence they kept.

Incident response

Cloud forensics depends on provider evidence

You get what comes through the hatch

Hand-drawn sketch: A torch, not a floodlight. Write the question first. It decides what is worth collecting.

Incident response

Forensics should answer specific questions

A torch, not a floodlight

Hand-drawn sketch: Reach ends at the last plug. An offline copy is not better storage. It is a missing route.

Incident response

Offline copies break attacker reachability

Reach ends at the last plug

Hand-drawn sketch: Set in concrete. Nothing can rewrite it until the clock runs out. Not them, not you.

Incident response

Immutable backups trade flexibility for protection

Set in concrete

Hand-drawn sketch: Two different clocks. One counts back to your last good copy. One counts forward to service.

Incident response

RPO and RTO answer different questions

Two different clocks

Hand-drawn sketch: The newest jar is the spoiled one. Restoring from after the intrusion brings the intrusion back with it.

Incident response

Restoring data can restore malware too

The newest jar is the spoiled one

Hand-drawn sketch: Not on the same switch. If the login that runs the estate also runs the backups, they fall together.

Incident response

Backup credentials deserve separate protection

Not on the same switch

Hand-drawn sketch: Bottom crate first. You cannot stand a service back up before the things it stands on.

Incident response

Recovery order follows dependencies

Bottom crate first

Hand-drawn sketch: As far back as the rope goes. Retention decides how far back you can reach for a clean copy.

Incident response

Backup retention determines how far back you can restore to escape corruption or compromise

As far back as the rope goes

Hand-drawn sketch: The drill that only restored the data. A recovery test has to exercise the people and the access, not just the bytes.

Incident response

Recovery tests include people and permissions

The drill that only restored the data

Hand-drawn sketch: Two different accidents. A snapshot rewinds a mistake. A backup outlives the machine.

Incident response

Snapshots and backups solve different failure modes

Two different accidents

Hand-drawn sketch: A wax seal on a postcard. A signature proves nothing was altered. It never hides a single word.

Cryptography

Digital signatures provide integrity, not secrecy

A wax seal on a postcard

Hand-drawn sketch: The new key starts today. Rotation protects what happens next. It cannot reach backwards.

Cryptography

Key rotation cannot undo past disclosure

The new key starts today

Hand-drawn sketch: The master stays behind the wall. Every object gets its own data key. The master only wraps the keys.

Cryptography

Envelope encryption separates data keys from master keys

The master stays behind the wall

Hand-drawn sketch: You cannot swap what you have not found. Crypto agility begins as a list of where the algorithms actually run.

Cryptography

Crypto agility starts with inventory

You cannot swap what you have not found

Hand-drawn sketch: The chart is on the wall. Encoding is a public conversion. Anyone can run it backwards.

Cryptography

Encoding is not encryption

The chart is on the wall

Hand-drawn sketch: The label throws the points. A classification only means something when the next step differs.

Data protection & privacy

Classification should change handling

The label throws the points

Hand-drawn sketch: Hand over the ticket, not the coat. Tokenisation changes what each system has to hold in the first place.

Data protection & privacy

Tokenisation changes what systems need to hold

Hand over the ticket, not the coat

Hand-drawn sketch: Follow the dye. Lineage shows every place a sensitive field actually ends up.

Data protection & privacy

Data lineage explains where sensitive data travels

Follow the dye

Hand-drawn sketch: The line goes round the building. Keeping data in a country tells you almost nothing about who can reach it.

Data protection & privacy

Data residency is not automatic security

The line goes round the building

Hand-drawn sketch: What you no longer hold. A retention date quietly shrinks the amount there is to steal.

Data protection & privacy

Retention is a security control

What you no longer hold

Hand-drawn sketch: Read a record. Which one?. Access logs without object detail cannot support an investigation.

Data protection & privacy

Data access logs need object context

Read a record. Which one?

Hand-drawn sketch: It reads the shape, not the reason. Two transfers, the same pattern, entirely different meanings.

Data protection & privacy

DLP can match data patterns but cannot reliably infer the business purpose of a transfer

It reads the shape, not the reason

Hand-drawn sketch: The name was the easy part. Anonymisation is a judgement about how easily someone could be singled out again.

Data protection & privacy

Anonymisation is about re-identification risk

The name was the easy part

Hand-drawn sketch: One person cannot move the needle. Differential privacy caps how much any single contribution can change the result.

Data protection & privacy

Differential privacy limits one person's influence

One person cannot move the needle

Hand-drawn sketch: Both answers, very different distances. When yes takes one step and no takes five, the choice is not really free.

Data protection & privacy

Consent interfaces can undermine genuine choice

Both answers, very different distances

Hand-drawn sketch: The pipe was laid for one thing. Purpose limitation turns every new use into a decision somebody has to take.

Data protection & privacy

Purpose limitation prevents silent mission creep

The pipe was laid for one thing

Hand-drawn sketch: A line on the plan, or a hole in the wall. The same privacy decision costs almost nothing early and a great deal late.

Data protection & privacy

Privacy by design moves decisions earlier

A line on the plan, or a hole in the wall

Hand-drawn sketch: Telling is not asking. A privacy notice explains what you do. Something else has to make it lawful.

Data protection & privacy

A privacy notice does not create permission

Telling is not asking

Hand-drawn sketch: The right ends where the index does. Access, correction and erasure all begin with being able to find the data.

Data protection & privacy

Data subject rights depend on finding the data

The right ends where the index does

Hand-drawn sketch: The shape survives the sieve. Counting groups can answer the question without naming anyone in it.

Data protection & privacy

Aggregation can reduce detail while preserving insight

The shape survives the sieve

Hand-drawn sketch: Nothing leaked. They still know. Ordinary facts joined together make a fact nobody ever handed over.

Data protection & privacy

Privacy risk includes inference, not just disclosure

Nothing leaked. They still know

Hand-drawn sketch: It will not turn without the reason. A lawful basis is what makes the processing permitted at all.

Data protection & privacy

Lawful basis is the reason processing is permitted

It will not turn without the reason

Hand-drawn sketch: One setting out of six. Consent is a lawful basis. It is not the one you start from.

Data protection & privacy

Consent is one lawful basis, not the default answer

One setting out of six

Hand-drawn sketch: The lines about you, not the page. The right reaches personal data, not every document that happens to contain it.

Data protection & privacy

Access rights concern personal data, not every document

The lines about you, not the page

Data protection & privacy

Erasure is not an absolute delete button

It will not travel the whole way

Hand-drawn sketch: Only what fits the frame. Portability covers data they provided, held by consent or contract, handled by machine.

Data protection & privacy

Data portability is narrower than a database export

Only what fits the frame

Hand-drawn sketch: Correct it once, then chase every copy. Rectification follows the data wherever it is kept, and wherever it was sent.

Data protection & privacy

Rectification requires organisations to be able to correct inaccurate personal data wherever it is maintained

Correct it once, then chase every copy

Hand-drawn sketch: Stopped, not shredded. Restriction pauses what you do with the data. It keeps the data.

Data protection & privacy

Restriction can pause use without erasing data

Stopped, not shredded

Hand-drawn sketch: A weighbridge on the line. An objection does not end the processing. It forces you to justify it.

Data protection & privacy

Objection changes the decision process

A weighbridge on the line

Hand-drawn sketch: A handle on the chute. If a machine decides on its own, there must be somewhere a person can step in.

Data protection & privacy

Automated decisions can require safeguards

A handle on the chute

Hand-drawn sketch: Only the tape leaves the room. Getting it right is one job. Being able to show it is another.

Data protection & privacy

Accountability means demonstrating compliance

Only the tape leaves the room

Hand-drawn sketch: It only checks the shape. A model picks what fits next. Nothing in it asks whether that is true.

AI security

An LLM predicts plausible continuations, not verified truth

It only checks the shape

Hand-drawn sketch: The board gets wiped. What you paste in is working material. It never becomes what the model knows.

AI security

Context is temporary working material, not permanent knowledge

The board gets wiped

Hand-drawn sketch: The filter slot is empty. Retrieval hands the model more paper. It does not make the paper right.

AI security

Retrieval adds documents, not guaranteed correctness

The filter slot is empty

Hand-drawn sketch: The dial only sets the spread. Turn it up and you get different answers, not truer ones.

AI security

Temperature changes variation, not factuality

The dial only sets the spread

Hand-drawn sketch: A sign, with no fence. A system prompt asks. On its own it prevents nothing.

AI security

System prompts are instructions, not a security boundary

A sign, with no fence

Hand-drawn sketch: It comes in round the back. Whatever the model returns is just text from somewhere else.

AI security

LLM output is untrusted input downstream

It comes in round the back

Hand-drawn sketch: New type, same roller. Fine tuning changes what comes out. It does not repair what is underneath.

AI security

Fine-tuning changes behaviour, not every limitation

New type, same roller

Hand-drawn sketch: The score covers this much. A benchmark measures the tasks it contains, nothing wider.

AI security

Benchmarks measure selected tasks, not universal capability

The score covers this much

Hand-drawn sketch: Checked at the door only. Who may use the service says nothing about what each answer may hold.

AI security

Access controls protect the service, not every answer

Checked at the door only

Hand-drawn sketch: When the answer gets a lever. The same text is a suggestion until something acts on it.

AI security

AI risk changes when output becomes action

When the answer gets a lever

Hand-drawn sketch: Secret rules, open letterbox. An attacker does not need your instructions to send you theirs.

AI security

Prompt secrecy does not solve prompt injection

Secret rules, open letterbox

Hand-drawn sketch: Blunt it before it lands. Model output is only text until something reads it as instructions.

AI security

Output encoding still matters around LLMs

Blunt it before it lands

Hand-drawn sketch: Material, never orders. Fetched text arrives from somewhere you do not control.

AI security

Retrieval content needs trust boundaries

Material, never orders

Hand-drawn sketch: It can say what it can see. Anything placed in the context can come back out in the answer.

AI security

A model can leak data present in its context

It can say what it can see

Hand-drawn sketch: Mind the gaps, plural. One filter has one blind spot, and attackers aim at it.

AI security

Guardrails are layers, not one magic classifier

Mind the gaps, plural

Hand-drawn sketch: Paint is not a barrier. Telling a model to refuse is a preference, never an enforcement point.

AI security

Telling the model to ignore attacks is not a hard boundary

Paint is not a barrier

Hand-drawn sketch: Approve what, exactly. A decision needs the facts that make it a decision.

AI security

Human approval needs meaningful information

Approve what, exactly

AI security

Tool descriptions are part of the control surface

The label is the lever

AI security

Agent memory can preserve poisoned context

It stays in the water

AI security

Agent identity should be separate from user identity

Two necks, one badge

AI security

Delegated agents create authority chains

The thread stays attached

AI security

Agent loops need budgets and stopping conditions

Something has to say enough

AI security

High-impact tools need stronger confirmation

Match the catch to the consequence

AI security

Tool results are untrusted inputs too

No sieve on the back route

AI security

Agent observability needs action-level traces

Ask for the receipt

AI security

Agent rollback is not always possible

The winch only reaches so far

AI security

A model file is executable trust in another form

It looks like data until you open it

Hand-drawn sketch: Where did this batch come from?. A training set is a delivery, and every delivery has a sender.

AI security

Dataset provenance matters for security and governance

Where did this batch come from?

Hand-drawn sketch: One plate swapped inside. Change the model version and the same request lands somewhere else.

AI security

Model version changes can be security changes

One plate swapped inside

Hand-drawn sketch: The fence moves with the call. A third party model puts their estate inside the boundary you are accountable for.

AI security

Third-party AI APIs extend the data boundary

The fence moves with the call

Hand-drawn sketch: It has already seen the exam. Once evaluation data reaches the training pile, the score stops measuring anything.

AI security

Evaluation data can leak into training

It has already seen the exam

Hand-drawn sketch: The bench feeds the floor. A fine tuning key writes into the very thing your customers are using.

AI security

Fine-tuning credentials are production credentials

The bench feeds the floor

Hand-drawn sketch: The engine comes with the engine room. Self hosting moves every job the provider was doing onto your side of the line.

AI security

Open models shift responsibility toward the operator

The engine comes with the engine room

Hand-drawn sketch: The shelf that ships. A model registry decides what goes live, so it is release infrastructure.

AI security

Model registries are release infrastructure

The shelf that ships

Hand-drawn sketch: Four parts, one entry. An inventory that names only the model is missing most of the system.

AI security

AI inventories need models, prompts, tools and data

Four parts, one entry

Hand-drawn sketch: Break it on paper first. Threat modelling asks how a design fails before anything is built.

Application security

Threat modelling asks how a design can fail before code exists

Break it on paper first

Hand-drawn sketch: One shape fits. Validation is the hole you cut, and it decides everything the application ever sees.

Application security

Input validation defines what the application accepts

One shape fits

Hand-drawn sketch: They go on the same sheet. A security requirement sits next to the feature it belongs to.

Application security

Security requirements are product requirements

They go on the same sheet

Hand-drawn sketch: The magnet and the eye. A scanner finds what it has a pattern for. A reader finds what makes no sense.

Application security

Code review and automated scanning see different risks

The magnet and the eye

Hand-drawn sketch: The load nobody specified. Expected use is one test. The abuse cases are all the others.

Application security

Security tests should exercise abuse cases

The load nobody specified

Hand-drawn sketch: Somebody left it up. A flag set once for a demo is a security setting from then on.

Application security

Feature flags can become security states

Somebody left it up

Hand-drawn sketch: Break the same way every time. Predictable failure is designed in. Unpredictable failure improvises.

Application security

Error handling should fail predictably

Break the same way every time

Hand-drawn sketch: It rides the same belt. Updating what you depend on is development work, not a separate project.

Application security

Dependency updates are part of development

It rides the same belt

Hand-drawn sketch: It grows into everything above it. One deferred update is inherited by every branch grown since.

Application security

Security debt compounds through dependencies

It grows into everything above it

Hand-drawn sketch: They came for one thing. An asset is what somebody wants to read, change, take or stop.

Threat actors & ATT&CK

Assets are what attackers want to affect

They came for one thing

Hand-drawn sketch: Every way up the same hill. An attack tree starts at the goal and works down to the ways of reaching it.

Threat actors & ATT&CK

Attack trees decompose goals into possible paths

Every way up the same hill

Hand-drawn sketch: It worked perfectly. An abuse case is the feature doing its job, for the wrong person.

Threat actors & ATT&CK

Abuse cases describe intentional misuse

It worked perfectly

Hand-drawn sketch: The plan stopped growing. The system kept changing long after the model was signed off.

Threat actors & ATT&CK

Threat models expire as systems change

The plan stopped growing

Hand-drawn sketch: Every thread ends on a peg. A control that answers no named threat is only effort.

Threat actors & ATT&CK

Mitigations should connect to specific threats

Every thread ends on a peg

Hand-drawn sketch: Two ways the same mast falls. Plenty of failures have nobody standing behind them.

Threat actors & ATT&CK

Threat models include failure without an attacker

Two ways the same mast falls

Hand-drawn sketch: Draw the pipes, find the crossings. A data flow diagram shows every point where data leaves your ground.

Threat actors & ATT&CK

Data-flow diagrams reveal hidden crossings

Draw the pipes, find the crossings

Hand-drawn sketch: The model stands on its assumptions. Write them down, because they are the part most likely to move.

Threat actors & ATT&CK

Assumptions are part of the threat model

The model stands on its assumptions

Hand-drawn sketch: Judge it by what changed. The point of the hour is a decision, not a completed document.

Threat actors & ATT&CK

Threat modelling is a decision tool, not a ceremony

Judge it by what changed

Hand-drawn sketch: One plank, every crossing. A jump host gathers all administrative entry into a single place.

Architecture & resilience

A jump host concentrates administrative entry

One plank, every crossing

Hand-drawn sketch: It only has the one job. Mail and browsing on the admin host undo the reason it exists.

Architecture & resilience

A bastion should not become a general-purpose workstation

It only has the one job

Hand-drawn sketch: The water stops at the wall. Partition a system and one failure stays where it started.

Architecture & resilience

Bulkheads contain failure

The water stops at the wall

Hand-drawn sketch: When the bridge is out. Out of band only counts when the second route shares nothing.

Architecture & resilience

Out-of-band management survives primary-path failure

When the bridge is out

Hand-drawn sketch: Everything through one gap. A choke point is what turns a control into something you can see.

Architecture & resilience

A choke point makes control observable

Everything through one gap

Hand-drawn sketch: Chained to the bench. A broker does the powerful thing so the client never holds the means to do it.

Architecture & resilience

A broker can separate clients from powerful credentials

Chained to the bench

Hand-drawn sketch: Water does not fall upwards. A one way gateway changes what can happen, not what is allowed.

Architecture & resilience

A one-way gateway changes the threat model

Water does not fall upwards

Hand-drawn sketch: A room with two gates. The second gate stays shut, and that is what buys the time to inspect.

Architecture & resilience

A quarantine zone creates time for inspection

A room with two gates

Hand-drawn sketch: The box on the embankment. The thing that sets the points does not stand on the track.

Architecture & resilience

Control planes should be separated from what they control

The box on the embankment

Hand-drawn sketch: Clamped onto the wire. A service mesh moves the controls into the layer the services talk through.

Architecture & resilience

A service mesh moves controls into the communication layer

Clamped onto the wire

Hand-drawn sketch: Still propped open. An exception with no expiry quietly turns into the standing rule.

Security fundamentals

A security exception with no expiry date can become a permanent control decision nobody deliberately made

Still propped open

Hand-drawn sketch: It fitted the gap. Phishing works on the context somebody is already in, not on how clever they are.

Human factors & social engineering

Phishing exploits context, not stupidity

It fitted the gap

Hand-drawn sketch: The bell nobody hears. Warn somebody every day about nothing and you have spent the warning.

Human factors & social engineering

A warning ignored every day stops being a warning

The bell nobody hears

Hand-drawn sketch: Squeeze it here, it comes out there. Security friction does not stop the task. It moves it somewhere you cannot see.

Human factors & social engineering

Security friction moves behaviour elsewhere

Squeeze it here, it comes out there

Hand-drawn sketch: Ask forty times. MFA fatigue turns your own approval into the exploit.

Human factors & social engineering

MFA fatigue weaponises repetition

Ask forty times

Hand-drawn sketch: Ring back on a line they never gave you. Verify an odd request somewhere the sender cannot follow.

Human factors & social engineering

Verify suspicious requests through a separate channel

Ring back on a line they never gave you

Hand-drawn sketch: The shortest road back. People report fast only when reporting is safe.

Human factors & social engineering

People need a safe way to report mistakes quickly

The shortest road back

Hand-drawn sketch: What you knew in March. Security training fades unless people keep using it.

Human factors & social engineering

Security training decays without practice

What you knew in March

Hand-drawn sketch: Bought, not earned. The signals we read as authority are cheap to copy.

Human factors & social engineering

Authority signals can be forged

Bought, not earned

Hand-drawn sketch: The tag faces away. A QR code carries a destination your eye cannot inspect.

Human factors & social engineering

QR codes hide destinations from casual inspection

The tag faces away

Hand-drawn sketch: Nobody had to spot it. A process control stops what detection never would.

Human factors & social engineering

Business process controls can beat perfect phishing detection

Nobody had to spot it

Hand-drawn sketch: Where it might land. Risk is uncertain effect on an objective, good or bad.

Governance & risk

Risk is about uncertain impact, not merely bad things

Where it might land

Hand-drawn sketch: Not a display case. A risk register exists to move decisions, not to store them.

Governance & risk

A risk register is a decision queue, not a museum

Not a display case

Hand-drawn sketch: Signed, and spent. Risk acceptance quietly spends a limited tolerance.

Governance & risk

Risk acceptance spends organisational tolerance

Signed, and spent

Hand-drawn sketch: Ticked, and still empty. A control that is present is not yet a control that works.

Governance & risk

Control effectiveness is separate from control existence

Ticked, and still empty

Hand-drawn sketch: The name, not the lever. Owning a risk means being able to change what happens next.

Governance & risk

Risk owners need authority over the consequence

The name, not the lever

Hand-drawn sketch: All on one leg. Concentration only appears once you add the separate entries together.

Governance & risk

Risk aggregation can reveal concentration

All on one leg

Hand-drawn sketch: Paint the line on the gauge. Appetite only becomes usable when it has a number and an action.

Governance & risk

Risk appetite needs operational thresholds

Paint the line on the gauge

Hand-drawn sketch: Two different acts. The people who advise on a risk should not be the people who accept it.

Governance & risk

Governance should distinguish advice from approval

Two different acts

Hand-drawn sketch: Wire the clause to something. A right to audit that nobody ever exercises is not a control.

Supply chain & third parties

Security clauses need operational follow-through

Wire the clause to something

Hand-drawn sketch: Name the join. Shared responsibility fails at the place neither side wrote down.

Supply chain & third parties

Shared responsibility should name the seam

Name the join

Hand-drawn sketch: They hold your start button. A supplier notification window is the first hours of your own response.

Supply chain & third parties

Supplier notification affects your response clock

They hold your start button

Hand-drawn sketch: Same review, very different reach. The supplier with the widest access needs the deepest scrutiny.

Supply chain & third parties

Privileged vendors deserve privileged controls

Same review, very different reach

Hand-drawn sketch: The pipe that goes back. Being able to leave a supplier is part of being able to recover.

Supply chain & third parties

Exit plans are security controls

The pipe that goes back

Hand-drawn sketch: A part, or the place. High availability and disaster recovery are answers to two different questions.

Architecture & resilience

High availability and disaster recovery solve different problems

A part, or the place

Hand-drawn sketch: The lighter side goes down. A dependency nobody lists can outweigh the system everyone watches.

Architecture & resilience

A dependency can be more critical than the application

The lighter side goes down

Hand-drawn sketch: The pipe gets narrower. A workaround that works is still a workaround with a rate and an end time.

Architecture & resilience

Manual workarounds have capacity limits

The pipe gets narrower

Hand-drawn sketch: Whose order is it?. Recovery sequence is a business decision, decided long before the day you need it.

Architecture & resilience

Recovery priorities should follow business outcomes

Whose order is it?

Hand-drawn sketch: The shelf runs out. Duplicated kit is the easy half. The other half wears shoes and sends invoices.

Architecture & resilience

Resilience includes people and suppliers

The shelf runs out

Hand-drawn sketch: The day it is asked. Standby that has never been started is a hope with a maintenance contract.

Architecture & resilience

Failover can fail if never exercised

The day it is asked

Hand-drawn sketch: Drop the ballast. A service that sheds its extras on purpose keeps the part people came for.

Architecture & resilience

Graceful degradation preserves the important part

Drop the ballast

Hand-drawn sketch: Back to when, not back on. Restarting answers an outage. Corruption asks which moment you can still trust.

Architecture & resilience

Recovery from corruption differs from recovery from outage

Back to when, not back on

Hand-drawn sketch: The route runs through it. A contact list that lives inside the broken system is not a contact list.

Architecture & resilience

Crisis communication needs alternate channels

The route runs through it

Hand-drawn sketch: Green all the way down. Every component can be healthy while the thing the customer came for never arrives.

Architecture & resilience

Resilience is a property of the whole service chain

Green all the way down

Hand-drawn sketch: The keystroke has a lever on the end. A command sent in the control room finishes as movement in the plant.

OT, ICS & cyber-physical

A cyber command can have physical consequences

The keystroke has a lever on the end

Hand-drawn sketch: Old, and holding the whole line. Age is not the reason it goes. Function is the reason it stays.

OT, ICS & cyber-physical

Legacy does not mean unnecessary

Old, and holding the whole line

Hand-drawn sketch: The patch waits for the plant. Severity says whether to fix it. The process says when you are allowed to.

OT, ICS & cyber-physical

Patching OT requires process context

The patch waits for the plant

Hand-drawn sketch: Bulkheads, not one big hold. Zone the plant so that a flood in one place is not a flood in every place.

OT, ICS & cyber-physical

Segmentation protects process zones

Bulkheads, not one big hold

Hand-drawn sketch: The fence now goes round their kitchen table. Every remote session stretches the plant boundary out to wherever the engineer is.

OT, ICS & cyber-physical

Remote maintenance changes the plant perimeter

The fence now goes round their kitchen table

Hand-drawn sketch: The plant noticed first. Process data is telemetry too, and often it is the earliest sign of all.

OT, ICS & cyber-physical

Process anomalies can be security signals

The plant noticed first

Hand-drawn sketch: Listen to it, do not knock on it. Some plant devices fall over the first time anybody scans them.

OT, ICS & cyber-physical

Asset discovery must not disrupt fragile systems

Listen to it, do not knock on it

Hand-drawn sketch: One word, printed a million times. A default credential is not one weak device. It is the whole fleet, at once.

OT, ICS & cyber-physical

A default password scales into a fleet vulnerability

One word, printed a million times

Hand-drawn sketch: The lid was the threat model. With the case open on a bench, the attacker starts inside the chip.

OT, ICS & cyber-physical

Physical access changes the embedded threat model

The lid was the threat model

Hand-drawn sketch: You sold the box, you signed up for the years. A support period is a promise with a length, and owners keep the thing past it.

OT, ICS & cyber-physical

Firmware updates are a long-term security promise

You sold the box, you signed up for the years

Hand-drawn sketch: Each link checks the next. Secure boot protects the chain that starts your device.

OT, ICS & cyber-physical

Secure boot protects the startup chain

Each link checks the next

Hand-drawn sketch: All answering to one name. Give every unit its own identity, or you can never single one out.

OT, ICS & cyber-physical

Device identity should be unique

All answering to one name

Hand-drawn sketch: The strings came from elsewhere. When the service is switched off, the device stops being smart.

OT, ICS & cyber-physical

Cloud shutdown can strand smart devices

The strings came from elsewhere

Hand-drawn sketch: No code was touched. Fool the sensor and the system obeys perfectly.

OT, ICS & cyber-physical

Sensors can be fooled without hacking software

No code was touched

Hand-drawn sketch: The service hatch is a door. A debug interface you can reach is a production interface.

OT, ICS & cyber-physical

Debug interfaces are production interfaces if accessible

The service hatch is a door

Hand-drawn sketch: Dot by dot, a person appears. Small readings collect into a picture nobody agreed to give.

OT, ICS & cyber-physical

IoT privacy risk grows as many small observations accumulate into a detailed picture

Dot by dot, a person appears

Hand-drawn sketch: The rain did not stop. End of support changes your risk without touching the device.

OT, ICS & cyber-physical

End-of-support is a security event

The rain did not stop

Hand-drawn sketch: One root under the whole forest. Domain Admin does not stop at the machine you are looking at.

Vulnerability management

Domain Admin is a forest-scale key

One root under the whole forest

Hand-drawn sketch: Whoever holds it, gets in. A Kerberos ticket is not a receipt. It is the credential.

Vulnerability management

Kerberos tickets are credentials

Whoever holds it, gets in

Hand-drawn sketch: They took the press, not a ticket. Golden Ticket attacks go after the account that signs every ticket.

Vulnerability management

Golden Ticket attacks target the ticket authority

They took the press, not a ticket

Hand-drawn sketch: One dial, every desk. Group Policy sets the whole fleet from a single place.

Vulnerability management

Group Policy is a fleet control plane

One dial, every desk

Hand-drawn sketch: One secret, or one each. The same local admin password on every build is a single point of collapse.

Vulnerability management

LAPS reduces shared local-admin secrets

One secret, or one each

Hand-drawn sketch: The hatch nobody bricked up. NTLM fallback leaves an older, weaker set of assumptions available.

Vulnerability management

NTLM fallback preserves older trust assumptions

The hatch nobody bricked up

Hand-drawn sketch: The pass with no face. A service account can hold full rights and appear on no list.

Vulnerability management

Service accounts can become invisible administrators

The pass with no face

Hand-drawn sketch: Separate benches, separate ladders. Tiering keeps a high privilege credential off a lower trust machine.

Vulnerability management

Tiered administration separates privilege contexts

Separate benches, separate ladders

Hand-drawn sketch: Send me everything you hold. Replication is a legitimate request for a complete copy.

Vulnerability management

Directory replication is a privileged capability

Send me everything you hold

Hand-drawn sketch: They put each other back. Restoring a domain is not the same job as restoring a server.

Vulnerability management

Active Directory recovery is not ordinary server restore

They put each other back

Hand-drawn sketch: The rope follows the wire. Scope is set by how the system is built, not by how it is described.

Governance & risk

Regulatory scope is a security architecture question

The rope follows the wire

Hand-drawn sketch: The clock starts with the incident. A statutory deadline competes for the same few people.

Governance & risk

Incident reporting deadlines change response priorities

The clock starts with the incident

Hand-drawn sketch: The work moves, the answering stays. DORA puts third party resilience into the contract and the oversight.

Governance & risk

DORA makes ICT third-party resilience a contractual and oversight responsibility for regulated financial entities

The work moves, the answering stays

Hand-drawn sketch: Three flaps, one outcome. Under NIS2, sector, size and role together decide whether the duties reach you.

Governance & risk

Under NIS2, an organisation's sector, size and role can determine whether cybersecurity risk-management and reporting duties apply

Three flaps, one outcome

Hand-drawn sketch: Two holes, two different shapes. One event, two separate legal tests, each with its own wording and its own clock.

Governance & risk

Breach notification and incident notification are different tests

Two holes, two different shapes

Hand-drawn sketch: It seals the advice, not the facts. Privilege can shape what you hand over. It cannot unhappen the incident.

Governance & risk

Legal privilege does not make incident facts disappear

It seals the advice, not the facts

Hand-drawn sketch: Their controls, on your sheet. Regulation pulls the people you buy from inside your own compliance system.

Governance & risk

Regulation can make suppliers part of your compliance system

Their controls, on your sheet

Hand-drawn sketch: One post, two boards. The principle was carved once. The board underneath keeps getting wiped.

Governance & risk

Law changes faster than evergreen security principles

One post, two boards

Hand-drawn sketch: The list said five. Knowing about a flaw is not the same as knowing the fix landed on every machine.

Incident response

Equifax: knowing about a vulnerability is not knowing it is patched

The list said five

Hand-drawn sketch: The partitions stop short. A supplier portal is only as separate as the wall between it and the tills.

Incident response

Target: supplier access showed why third-party portals need strong segmentation from sensitive systems

The partitions stop short

Hand-drawn sketch: Nothing touched the pipe. When the business systems went down, the operator closed the line.

Incident response

Colonial Pipeline: business shutdown can follow IT compromise

Nothing touched the pipe

Hand-drawn sketch: Three answers, and it moves. If a phone call can move the second factor, the phone call is the way in.

Incident response

Help-desk identity processes are attack surfaces when social engineering can trigger password resets or MFA transfer

Three answers, and it moves

Hand-drawn sketch: The outage was the short part. Getting back to normal can take far longer than the disruption that started it.

Incident response

British Library: recovery can outlast initial disruption

The outage was the short part

Hand-drawn sketch: A hand apart. Hawaii false missile alert: test and live alert paths need separation because confirmation prompts cannot correct a convinced operator.

Incident response

Hawaii false missile alert: test and live alert paths need separation because confirmation prompts cannot correct a convinced operator

A hand apart

Incident response

CrowdStrike 2024: trusted security software can be concentration risk

One roller, every machine

Incident response

LastPass: protecting vaults includes developer and backup paths

Three of the same thing

Incident response

Okta support compromise: support artefacts can contain session power

The log had a wristband in it

Metrics, decisions & economics

Security competes for finite organisational attention

Everything else is on the same bench

Metrics, decisions & economics

Security spend should follow risk concentration

The same trickle everywhere

Metrics, decisions & economics

Security creates option value during incidents

The siding was laid years ago

Metrics, decisions & economics

The cheapest control can be removing the feature

Unbolt it and the rest goes too

Metrics, decisions & economics

Security debt is borrowed future effort

Still tied on

Metrics, decisions & economics

Executive decisions need ranges, not false precision

Measure the width

Hand-drawn sketch: You only have so much fence. Strategy is deciding what you are not going to protect.

Metrics, decisions & economics

Security strategy means not protecting everything equally

You only have so much fence

Metrics, decisions & economics

A control can cost more than the risk it reduces

The bill is longer than the loss