Field Notes
What we write about.
Notes from actual engagements, patterns we keep seeing, and explanations of things that are frequently misunderstood. Written for people running businesses, not security teams.
Phishing
Phishing defence for a business without an IT department
Practical controls that cost nothing to implement, and the single procedural change that makes the biggest difference.
Certification
Cyber Essentials: what it actually covers and what it doesn't
The government-backed certification is worth having. But most businesses get it without understanding its limits. Here's what it covers and what remains your responsibility.
Remote Work
The remote work security checklist your IT supplier probably skipped
When businesses moved to remote work, certain controls got skipped in the rush. This is the list of things most commonly left unaddressed.
Email updates
New articles by email — no frequency commitments, no promotional content.