Security Engineer

Practical security, from the incident room to the audit.

Field notes on incident response, compliance, and hardening real-world systems. Written for practitioners and anyone building a security program that holds up.

All posts Start here

Latest post

Incident ResponseOctober 10, 2026 12 min read

The Client's Website Got Blocklisted, Then ZAP Came for Their Inbox

A URL reputation hit turned ZAP against a client's own mail. How we proved it, beat the quarantine expiry clock, and released 1,600 messages safely.

Read the post →

Focus areas

Incident Response & Forensics

Triage, containment, and root cause: lessons from leading real investigations.

3 posts →

GRC & Compliance

CMMC, HIPAA, PCI DSS, and SOC 2, turned into controls that actually work.

Posts coming

Hardening & Deployment

EDR, allowlisting, mail filtering, and locking down the systems everyone forgot about.

3 posts →

The Fake Microsoft Login Page That Registered a Device

An AiTM phishing page proxied a real Microsoft 365 sign-in and registered an attacker device. Covers triage, containment, and the controls that stop it.

The Vendor Was the Phish: Responding to an AiTM Compromise in Microsoft 365

A trusted vendor's share link led to AiTM token theft and a phishing run from our user's mailbox. How we scoped it, cleaned it up and what stops it.

Killing Sweet32 on Windows with PowerShell

Sweet32 (CVE-2016-2183) is one of the most common scan findings on Windows. Here's how to find and kill 3DES suites with built-in PowerShell cmdlets.

Shutting Down Direct Send in Microsoft 365 (Without Breaking Your Printers)

Block unauthenticated Direct Send spoofing in M365 without breaking legacy apps and printers. Find your legitimate senders, create inbound connectors, and flip RejectDirectSend.

The NetBIOS Finding That Wasn't About NetBIOS

A null session finding pointed at NetBIOS. NetBIOS was already off. The real gap was a named pipe exception list our hardening never touched.