Blog
Security guidance you can act on this week.
Practitioner-written notes on compliance, testing and response for Australian teams.
Latest
Essential Eight explained: what each maturity level actually requires
A plain-English guide to the ACSC Essential Eight strategies and Maturity Levels One to Three, and how to choose the right target for your organisation.
Read articleIncident response · 4 November 2026 · 3 min read
Notifiable Data Breaches: what to do in the first 72 hours
A practical triage plan for the first three days after a suspected data breach under Australia's Notifiable Data Breaches scheme.
Read articleCompliance · 3 November 2026 · 3 min read
ISO 27001 readiness: a practical first 90 days for small teams
How a small team can scope an ISMS, run a risk assessment and build the core ISO/IEC 27001:2022 documents in the first 90 days.
Read articleCompliance · 2 November 2026 · 3 min read
SOC 2 vs ISO 27001: which one your customers are really asking for
How SOC 2 and ISO 27001 differ in scope, output, cost drivers and buyer expectations, and how to decide which to pursue first.
Read articleTesting · 31 October 2026 · 3 min read
Penetration testing: what a good scope, report and retest look like
How to scope a penetration test properly, what a useful report contains, and why the retest is where the value is realised.
Read articleAppSec · 30 October 2026 · 3 min read
Threat modelling for software teams: STRIDE in one afternoon
A lightweight, repeatable way for software teams to threat model a feature or product with STRIDE in a single working session.
Read articleEmail security · 29 October 2026 · 2 min read
SPF, DKIM and DMARC: stop your domain being used for phishing
What SPF, DKIM and DMARC do, how they work together, and a safe path from monitoring to an enforcing DMARC policy.
Read articleThird-party risk · 28 October 2026 · 2 min read
Vendor risk: the security questionnaire questions that matter
Cut vendor questionnaires down to the questions that reveal real risk, and learn what good and worrying answers look like.
Read articleIncident response · 27 October 2026 · 2 min read
Writing an incident response plan your team will actually use
How to write a short, practical incident response plan with clear roles, severity levels and playbooks your team can follow under pressure.
Read articleCloud · 26 October 2026 · 3 min read
Cloud security baseline: identity, logging and encryption first
A practical starting baseline for AWS, Azure or Google Cloud that focuses on identity, logging and encryption before anything else.
Read article