Writing
Field notes & case studies
How I think about securing and running real IT environments — the engagements, the trade-offs, and the lessons worth writing down.
- 2 min read
Containing a business email compromise in Microsoft 365
The playbook I run when a client's Microsoft 365 account is taken over — how to contain the intruder fast, stop the fraudulent payment, and close the door they came in through.
Incident ResponseMicrosoft 365Entra IDEmail Security - 1 min read
Hardening Microsoft 365 for a 50-seat firm
How I took a mid-sized professional services firm from a flat, password-only Microsoft 365 tenant to a Zero-Trust baseline — without grinding the team's day-to-day to a halt.
Microsoft 365Zero TrustEntra ID - 1 min read
Building an AI triage layer for a small SOC
A two-person security team was drowning in alerts. Here's the lightweight AI triage layer I built to cut the noise — and the guardrails that kept it from becoming a liability.
AISOCAutomationIncident Response - 2 min read
Modernising endpoint management for a hybrid workforce
Moving a distributed team off hand-built laptops and onto Intune-managed, compliance-gated devices — without a disruptive re-image weekend or a helpdesk revolt.
IntuneEndpoint SecurityZero TrustMicrosoft 365