Security Engineer

Practical security, from the incident room to the audit.

Field notes on incident response, compliance, and hardening real-world systems. Written for practitioners and anyone building a security program that holds up.

All posts Start here

Latest post

ComplianceOctober 22, 2026 14 min read

Compliance, A History: HIPAA, PCI DSS and CMMC for New GRC Folks

Where HIPAA, PCI DSS and CMMC came from, how each is structured and leveled, and where the official source documents live. A starting map for new GRC folks.

Read the post →

Focus areas

Incident Response & Forensics

Triage, containment, and root cause: lessons from leading real investigations.

3 posts →

GRC & Compliance

CMMC, HIPAA, PCI DSS, and SOC 2, turned into controls that actually work.

1 post →

Hardening & Deployment

EDR, allowlisting, mail filtering, and locking down the systems everyone forgot about.

4 posts →

PHP2Shell in Context: How CVE-2026-109618 and CVE-2026-109619 Compare to PHP's Older RCEs

PHP2Shell breaks PHP before your app code runs. How it lines up against CVE-2012-1823, CVE-2019-11043 and CVE-2024-4577, and why this blast radius is bigger.

The Client's Website Got Blocklisted, Then ZAP Came for Their Inbox

A URL reputation hit turned ZAP against a client's own mail. How we proved it, beat the quarantine expiry clock, and released 1,600 messages safely.

The Fake Microsoft Login Page That Registered a Device

An AiTM phishing page proxied a real Microsoft 365 sign-in and registered an attacker device. Covers triage, containment, and the controls that stop it.

The Vendor Was the Phish: Responding to an AiTM Compromise in Microsoft 365

A trusted vendor's share link led to AiTM token theft and a phishing run from our user's mailbox. How we scoped it, cleaned it up and what stops it.

Killing Sweet32 on Windows with PowerShell

Sweet32 (CVE-2016-2183) is one of the most common scan findings on Windows. Here's how to find and kill 3DES suites with built-in PowerShell cmdlets.

All posts →