Resources
Shorter pieces on things we keep having to explain.
Showing 4 of 4 items — 4 still being written, and each one says so on its own page.
Closing instances of a bug class does nothing about the class. On one platform authorisation was decided in 40 places and no engineer could enumerate them. The fix that worked was not a code review — it was a typed helper plus a lint rule that makes the insecure call impossible to write.
Nineteen months of green dashboards, a dump that excluded a schema added in 2023 because the script enumerated from a list written in 2019, and a service that could not start from it. A control that has never been executed is a hypothesis — here is how to test the four that matter.
The scope had been drawn around the whole organisation instead of the service that needed the certificate, which multiplied 61 applicable controls into 142 across business units with no involvement in it. Scope is the first decision and the most expensive one to get wrong.
A red team against an estate that has never had a penetration test will find the unauthenticated file upload at red team rates and teach you nothing about your detection, because the engagement ended at the first open door. What to buy first, and how to tell when you are ready.