Security work that runs at machine speed
Attacks moved to machine speed years ago. Most defensive programmes still make decisions at human speed, and the gap is where incidents live. These essays are about closing it — treating detections as software, automating response without automating mistakes, and being honest about what a severity score can and cannot tell you.
All essays
- Tools That Survive Contact With Your Environment
Security tooling is usually evaluated on capability and fails on integration. The questions that predict whether a product will work are mostly about your estate, not the product.
- Machine Speed Attacks, Human Speed Decisions
The tempo gap between automated attacks and human response is not closed by hiring. It is closed by deciding in advance, which means the real work happens before the incident.
- Asset Inventory Is the Security Programme
Every security capability silently assumes a correct inventory. When the inventory is wrong, detection, vulnerability management and response all degrade in ways that are hard to attribute back to the cause.
- What a Severity Score Actually Tells You
A CVSS base score describes a vulnerability in isolation, by design. Treating it as a priority queue is the most common and most expensive misreading in vulnerability management.
- Automating Response Without Automating Mistakes
Automated response fails in a specific way — it executes a wrong decision faster and more consistently than a human ever could. The design problem is bounding blast radius, not writing the playbook.
- The Alert Nobody Reads
Alert fatigue is usually described as a volume problem. It is closer to a precision problem, and the fix is unpopular because it means deleting detections you spent money building.
- Detection Engineering Is a Software Discipline
Detections are code that runs in production against hostile input. Teams that treat them as configuration keep rediscovering why software engineering invented tests, review and version control.