The most useful phrases in a modern security programme are the ones that cannot be argued with. “The platform gives us coverage.”, “We have visibility.”, “The tool supports MFA.” Each one is calm, professional, and technically defensible. Each one can also be doing something quietly different from what the room hears. …
Across many mature organisations, the same phrases seem to keep coming back, like “Aligned with best practice”, “The control is in place”, and “We followed the framework”. They survive failure. They survive scandal. They survive the people who used them last time. The question worth asking is perhaps not whether they a…
Organisations invest heavily in procedures, certifications, and standards. Yet whether those investments deliver results depends on something far less tangible: human relationships. As organisations become more distributed and interdependent, seeing and strengthening these connections becomes critical to resilience. Th…
A developer pushes a feature. Security flags a missing TLS configuration. Operations scrambles to patch the database. Alerts multiply while emails ping insistently and no one knows who owns what. Technical pipelines are fine. The human side stutters. Miscommunication, conflicting priorities, and unspoken assumptions sl…
Introduction A SOC alert does not knock politely. It arrives like a crowd of people shouting different instructions in a language only half understood. One alert maybe says “ransomware detected,” another could flag “unusual login,” and the logs you trust most are blank. Analysts glance at dashboards, shrug, and whisper…
There is a certain bleak poetry in a security audit. The word audit evokes clipboards, compliance spreadsheets, and the faint smell of burnt patience. But beneath the bureaucracy lies something far more interesting: an act of seeing. A real audit, not compliance theatre, but the kind that leaves everyone quietly re-eva…
If you have ever tried to set up a Security Incident Response Team (SIRT) function in a small organisation, you will know that it is not about security, incidents, or even teams. It is about humans behaving badly under stress. Enter the Satir Change Model, a tool from family therapy that has no right working in cyberse…