Resources

What we publish, and what we publish it for

Findings from our own engagements with the data and the method attached, the methodologies we run so you can hold us to them, and the tools we built because we kept needing them. One thing on this site sits behind a form, and it is marked as such.

• ResearchFeatured12 min read

  Identity-path analysis beats configuration scanning: 14 cloud estates reviewed

  In eleven of fourteen cloud reviews there was at least one path from a low-privilege identity to full account administrator. In none of them did a posture tool rank any individual step above medium, because individually none of them is above medium. Includes the method, the anonymised path shapes, and why filtering a findings list by reachability reduced one estate from 1,840 to 210 in a day.

  DO

  Daniel Okafor · 18 Sept 2026Read research
• ResearchFeatured9 min read

  A third of configured log sources deliver nothing: what we find during MDR onboarding

  Across managed detection onboardings, a median of 31% of configured log sources had never delivered a single event, and several more had stopped silently after a platform upgrade. Dashboards report configured status, not delivery. The method for checking is included and takes an afternoon.

  DO

  Daniel Okafor · 2 Jul 2026Read research
• Open-source toolFeaturedGitHub

  trustgraph — enumerate every privilege path in an AWS organisation

  Reads actual IAM policy documents, trust relationships, permission boundaries and SCPs rather than the console summary, and outputs the reachability graph as queryable data. Runs from a read-only role you create and can delete. MIT, no telemetry, no account required.

  DO

  Daniel Okafor · 30 May 2026View tool
• GuideFeaturedPDF, 38 pages

  The secure SDLC field guide: moving findings earlier without slowing delivery

  The threat-modelling workshop format, the decision-record review checklist, how to tune a pipeline gate to a finding budget delivery teams accept, and the cycle-time measurement that tells you whether any of it is working. 38 pages.

  SM

  Sofia Marek · 3 Mar 2026Get the guide
• MethodologyFeaturedPDF, 9 pages

  How we score severity, and why we show the adjustment

  CVSS v4.0 base plus an environmental adjustment, with the reasoning stated in one sentence per finding — including the cases where we adjust a score up. Published so you can disagree with us precisely rather than generally, and so an auditor can see the number was reasoned rather than assigned.

  IH

  Imran Haque · 11 Feb 2026Read methodology
• Insight7 min read

  Why your authorisation bug keeps coming back

  Closing instances of a bug class does nothing about the class. On one platform authorisation was decided in 40 places and no engineer could enumerate them. The fix that worked was not a code review — it was a typed helper plus a lint rule that makes the insecure call impossible to write.

  SM

  Sofia Marek · 14 Oct 2026Read article
• Webinar50 min watch

  DORA threat-led penetration testing: what the independence criteria actually mean

  Fifty minutes on where the provider independence requirements bite, why some firms can supply the threat intelligence or the testing but not both, and how to avoid discovering that after the exercise. Recording is not gated.

  CB

  Claire Benoit · 25 Sept 2026Watch webinar
• Insight6 min read

  A backup job reporting success is not a backup

  Nineteen months of green dashboards, a dump that excluded a schema added in 2023 because the script enumerated from a list written in 2019, and a service that could not start from it. A control that has never been executed is a hypothesis — here is how to test the four that matter.

  PR

  Priya Raman · 21 Aug 2026Read article
• Open-source toolGitHub

  logsource-check — prove your log sources are actually delivering

  Compares configured sources against events actually received over a window, per source and per host, for Sentinel, Elastic and Wazuh. Written because we kept finding dead sources by hand on onboarding. MIT.

  DO

  Daniel Okafor · 2 Jul 2026View tool
• Insight8 min read

  Four days of scoping undid two years of a stalled ISO 27001 attempt

  The scope had been drawn around the whole organisation instead of the service that needed the certificate, which multiplied 61 applicable controls into 142 across business units with no involvement in it. Scope is the first decision and the most expensive one to get wrong.

  CB

  Claire Benoit · 5 Jun 2026Read article
• Insight5 min read

  Do not buy a red team yet

  A red team against an estate that has never had a penetration test will find the unauthenticated file upload at red team rates and teach you nothing about your detection, because the engagement ended at the first open door. What to buy first, and how to tell when you are ready.

  IH

  Imran Haque · 9 Apr 2026Read article
• MethodologyPDF, 14 pages

  Web application and API testing methodology

  Scope, phases, coverage against OWASP ASVS 4.0 and WSTG, what we confirm by hand versus what tooling covers, the escalation path for a critical found mid-engagement, and the explicit list of what we do not test and why.

  IH

  Imran Haque · 20 Jan 2026Read methodology