Thoughts on Security

Notes from the SOC floor and the remediation queue.

Notes from the intersection of threat detection, vulnerability management, incident response, and security operations.

How I Prioritize Vulnerabilities Beyond CVSS

CVSS tells you how bad a vulnerability could be. It doesn't tell you how likely it is to be exploited, or whether it matters on your estate. Here's the model I use to close that gap.

Jul 14, 2026·7 min read

Threat Hunting

A Practical Approach to Threat Hunting with KQL

Threat hunting isn't running a bigger query. It's starting from a hypothesis, and being willing to be wrong. Here's the loop I use inside Microsoft Sentinel and Defender for Endpoint.

Jun 2, 2026·8 min read

Incident Response

How to Investigate a Suspicious Phishing Alert

Most phishing alerts are noise. The ones that aren't need a consistent chain of investigation from the message itself to endpoint and network impact before you can call a verdict.

Apr 21, 2026·6 min read

Security Operations

From Alert to Incident: A Practical SOC Investigation

Not every alert is an incident, and not every incident starts as an alert. Here's how I think about the line between triage and investigation, and what has to happen before an alert earns the word 'incident.'

Feb 10, 2026·6 min read

Vulnerability Management

Why Vulnerability Counts Don't Tell the Whole Story

'We closed 4,000 vulnerabilities this quarter' sounds like progress. It might not be. Raw counts hide which vulnerabilities actually mattered.

Dec 8, 2025·5 min read

Threat Detection

Building Better Detection Logic with Endpoint Telemetry

Good detection logic isn't a longer list of indicators. It's built around behavior, tuned against your own environment's baseline, and written to survive the moment an attacker changes one detail.

Oct 19, 2025·7 min read

Email Security

Email Security: SPF, DKIM, and DMARC

Most malware and phishing still arrives by email. SPF, DKIM, and DMARC are the three DNS-based controls that decide whether a spoofed message ever reaches an inbox.

Feb 2, 2023·6 min read

Web Application Security

xmlrpc.php: The WordPress Endpoint That Won't Go Away

xmlrpc.php enables legitimate remote publishing, but the same features that make it useful (multicall, pingback) make it a reliable brute-force amplifier and a way to unmask an origin IP hiding behind a CDN.

Nov 8, 2024·7 min read