Insights
Notes from the work, not from the news cycle.
Short, practical writing on identity, recovery, and the controls reviewers actually ask for. No theater.
October 10, 2026
The account nobody turned off: why access reviews are the audit finding that keeps coming back
Reviewers don't need a breach to write you up. One active account belonging to someone who left months ago is enough. A short, repeatable access review closes the gap faster than any new tool.
ReadSeptember 10, 2026
MFA and backups you can restore still change the ransomware math
Most ransomware incidents are not genius zero-days. They are stolen passwords and backups nobody can restore. Multi-factor authentication and tested, offline backups are still the two cheapest controls that change the outcome.
Read