Blog

1. 01SIEM2026-08-04 · 9 minCan a log be evidence"We keep logs" does not survive an incident. The question is not whether they are stored, but whether you can prove they were not changed.
   Each block hash includes the previous one. Altering a single record in block two therefore makes every block after it fail to verify.
2. 02DDoS2026-07-22 · 8 minWhy blocking itself becomes the load"We block the attack" is not a specification. The question is which layer performs the block, and what it costs you.
   One request, two prices. The upper path pays for the connection, the handshake and the response before writing 403; on the lower one the packet never reaches the application.
3. 03Email security2026-07-09 · 8 minWhat happens to a message when the scanner does not answerAlmost nobody asks this when choosing a mail gateway. It is the first path an attacker tests.
   The third outcome — the scanner did not answer — is not "clean". The correct answer is 451: the message is not lost, it is deferred and inspected on redelivery.
4. 04Threat intel2026-06-25 · 7 minA leaked password is a state, not a growing number"11,000 leaked credentials found for your domain" tells you nothing. That number only ever goes up.
   A finding moves through four states, in one direction only. The number that goes in the report is active risk — because it is the only one that can fall.
5. 05Email security2026-06-11 · 5 minWhy a 64 MB archive has to be openedBlocking archives and passing them unopened are both wrong answers. The right one is to open them under a budget — and the budget needs two thresholds, not one.
   One threshold either lets the bomb through or blocks an honest report. Two remove the trade-off: 100× quarantines, 500× rejects.
6. 06DDoS2026-05-28 · 5 minDNS failover: TTL promises, the resolver decidesDropping TTL to 60 seconds does not give you a one-minute failover. When traffic moves is governed by other people’s caches, not by your configuration.
   Nothing refreshes in unison when a TTL expires. Traffic moves in steps, and the last percent waits longest — that tail is what plans leave out.
7. 07WAF / ADR2026-05-14 · 5 minWhat a rate limit actually counts"We rate-limit requests" is half an answer. The real question is what the limit keys on, and what changing that key costs an attacker.
   The lower the key, the cheaper it is to change. The account identifier is the most expensive key, which is why the limit should hang there first.
8. 08WAF / ADR2026-04-27 · 5 minWhy a WAF never leaves monitoring modeMany WAFs never move to blocking. The reason is not technical: the numbers needed to make the move were never agreed in advance.
   Monitoring is the name of a stage, not of a steady state. Selective blocking begins once the baseline exists — and that is the step most deployments never take.
9. 09Email security2026-04-09 · 5 minSPF passed, and the message is still forged"SPF check passed" does not mean the message is genuine. It means the sending server was authorised for its own domain — an entirely different claim.
   SPF checks the envelope domain, not `From:`. For a message to count as genuine, the check has to pass and the checked domain has to match `From:`.
10. 10Threat intel2026-03-24 · 5 minHow an external attack surface list goes staleAn asset list is compiled once and starts drifting from reality that same day. The problem is not the completeness of the list but the absence of a mechanism to refresh it.
    A list built from one source is always incomplete. Certificate transparency logs are the most useful addition: an unpublished subdomain becomes visible the moment a certificate is issued.
11. 11SIEM2026-03-05 · 5 minWhy a SOC cannot read ten thousand alertsMore alerts does not mean better detection. Usually it means the opposite: rules were written and their precision was never measured.
    The two errors are not equal: a miss costs more but is invisible, while a false positive is cheap, visible daily, and spends the analyst’s trust.
12. 12WAF / ADR2026-02-17 · 5 minWhere TLS is terminated, and who holds the keyAny protective layer has to see the traffic, and seeing it means terminating TLS. So the question is never whether it is decrypted — it is where, and who holds the key.
    Inspection needs unencrypted content, so TLS terminates wherever protection sits. The question begins afterwards: where is the key, and is the next leg encrypted?

Hover a post