July 24, 2026
Business email compromise: the scam built for 15-person companies
No malware, no hacking tools, just email and patience. How BEC actually unfolds at small businesses and the 4 controls that stop it.
July 2, 2026
The cybersecurity tabletop exercise that produces decisions, not a filed PDF
How to run a cybersecurity tabletop exercise that surfaces real gaps and ends with named owners and dates, instead of a 3-hour meeting that produces a PDF for the auditor and nothing else.
April 20, 2026
Post-incident review, what to document, what to change
A practical format for the post-incident review that produces operational improvements instead of blame, scar-tissue over-correction or a forgotten document nobody reads again.
April 20, 2026
Incident response when you don't have an in-house team
How small and mid-market firms actually respond to cybersecurity incidents without a dedicated security team, from MDR coverage to IR-firm retainers to executive decision-making during the first 4 hours.
April 20, 2026
Your first ransomware tabletop, a sample script
A working sample script for a mid-market firm's first ransomware tabletop exercise, including agenda, scenario, injects, decision points and the artifacts it should produce.
April 19, 2026
What a ransomware incident actually costs
The real cost categories of a modern ransomware incident, why the ransom is usually the smallest line item and how mid-market CFOs should frame the exposure.