What we learn breaking things, written down.

Not thought leadership. The arguments we have with customers about coverage, chaining and proof, set out properly so you can disagree with them.

GOVERNANCE/29 August 2026/2 min read

Scope is the product

The first question to ask about an autonomous attacker is not how good it is. It is how you stop it, and what it does at the boundary you drew.

READ THE POST

Your asset inventory is not your attack surface

Every inventory is a list of things somebody remembered to write down. An attacker enumerates what is reachable, which is a different set and always a larger one.

DISCOVERY/26 August 2026/2 min

What a proof has to contain

A screenshot is not evidence. If your engineers cannot reproduce a finding without asking a question, it is a claim, and claims do not get prioritised.

PRACTICE/21 August 2026/2 min

Three mediums are a critical

Severity is assigned per finding, but attackers do not use findings one at a time. The chain is the vulnerability, and almost nothing scores it.

METHOD/12 August 2026/2 min

Twenty-eight days a year is not a security programme

Two engagements a year gives you 28 days of coverage against an estate that changes every week. The gap is not your team. It is the window.

THREAT MODEL/4 August 2026/2 min