This category explores the strategic layer of cyber security — where long‑term vision, technical architecture, and governance intersect. It covers how organisations design secure systems, build resilient architectures, align security with business goals, and navigate frameworks, risk, compliance, and regulatory expectations. From high‑level strategy to practical implementation, these articles break down the thinking, structures, and decision‑making that shape modern security programs.
A short briefing for leaders on why post‑quantum cryptography matters now. Quantum computing still sounds like science fiction to many people. But the reason to prepare isn’t that quantum computers will break the internet tomorrow. It’s that some of the cryptography organisations rely on today will eventually need replacing. The Real Problem The main concern
My interest in incident response started years ago during my first university course on the subject. It was the first time I’d seen how structured, disciplined, and genuinely powerful a well‑designed Incident Response Plan could be. That early exposure stayed with me. Later, when I began studying NIST CSF 2.0, I noticed something interesting: the
Incident Response Series Round‑Up: IRP, PIR, Tabletop Exercises & NIST CSF 2.0 Read More »
My role as an analyst is managing incidents end‑to‑end, escalating when needed, and often acting as the point of coordination during active events. So I wanted to walk through how an Incident Response Plan is actually used during a live incident, the practical, real‑time steps that matter when you’re the one guiding the response. Most
How to Use Your IRP During an Incident (Aligned to NIST CSF 2.0) Read More »
Series Introduction Every IRP, PIR, playbook, and tabletop in this series maps back to NIST CSF 2.0. If you want your security work to look mature, consistent, and defensible, you can’t just say “we follow NIST CSF 2.0.” You need to understand how Functions, Categories, and Outcomes actually fit together and how to use those
Whenever I run a tabletop exercise, the first thing I do is set the tone for the room. I tell everyone that this is not a test and it’s not about catching anyone out. It’s a safe space to walk through our policies, procedures, and decision‑making as a team. The goal is to explore how we work, not judge how anyone performs.
A good tabletop lives or dies on facilitation. A script doesn’t remove spontaneity, it creates psychological safety. It gives the facilitator a structure to fall back on, keeps the room aligned, and ensures the exercise stays focused on process rather than personalities. This script is written so that even a first‑time facilitator can run the scenario confidently while still leaving space for natural discussion and team dynamics.
How to Run a Cybersecurity Tabletop Exercise: Facilitator Script with Discussion Prompts Read More »
An After‑Action Report is where a tabletop exercise turns into something real. It’s the moment where the conversation becomes clarity, and clarity becomes improvement. This AAR captures not just what happened in the scenario, but how the team thought, reacted, hesitated, and learned, because that’s where the real value sits.
How to Write an After Action Report (AAR) for Cyber Tabletop Exercises Read More »
A participant handout sets the tone for the entire exercise. It gives everyone the same starting point, removes uncertainty, and helps people focus on the scenario rather than trying to remember process details. This one is designed to be read in under two minutes, just enough to orient the room without overwhelming it.
How to Create a Participant Handout for a Cybersecurity Tabletop Exercise Read More »
A PIR isn’t just paperwork. It’s where the real learning happens. It’s the document that turns an incident into improvement. To show you what a mature, well‑structured PIR looks like in practice, here’s a full example based on a realistic MFA fatigue and OAuth compromise scenario.
How to Write a Post-Incident Review (PIR) Report (With Real-World Example) Read More »
This article isn’t just a guide, it’s a complete, modern Incident Response Plan aligned to NIST CSF 2.0. A full, real‑world IRP you can use as a reference, benchmark, or starting point for your own organisation.
How to Build an Incident Response Plan: A Complete NIST CSF 2.0 Example Read More »
