-
The Joins Nobody Owns: How Identity, Asset, and Rotation Registries Get Wired Together
The last essay in the identity series ended with a promise: the next thread would cover the joins. This is that essay — why the join between your identity provider and your asset inventory is a maintained artefact with an owner, what happens to an exercise when the join is stale, and why the join work is where a quarterly cadence quietly dies.
-
Quarterly Cadence: How Identity Purple Teaming Survives a Year in a Regulated Environment
The first three essays in this thread built the framework. The fourth is the one the framework was for: what happens when the same exercise runs four quarters in a row in the same environment, against the same boundary, with the previous gap list as its scope. This is a longitudinal essay — one anonymised regulated environment, four quarterly runs, the deltas in the gap list, the CDE model, the response time, and the evidence pack. It closes the identity series with the thing the previous essays deferred: a cadence that survives a year.
-
Purple Teaming a PCI Environment: What a Generic Identity Exercise Misses
A generic identity-focused purple team exercise will tell you whether you can detect a credential-driven intrusion. A PCI environment is a different problem. The Cardholder Data Environment is segmented, the QSA is watching, the assessor sign-off is at stake, and the parts of the framework that hold in a flat enterprise are the parts that break first behind a PCI scope. This is the essay on what changes when the perimeter is a regulated one, and why a generic exercise is the wrong shape of test
-
Containing a Credential-Driven Intrusion: What Good Looks Like in the First Hour
Detection is half the problem. The other half is what happens in the first hour after the SOC believes the credential is real — the joins, the actions, the order, and the things the playbook never rehearsed. This is the response side of identity-focused purple teaming
-
Purple Teaming Identity Systems: A Practitioner's Guide
Identity is the perimeter most attackers now attack first. This is the guide to a purple team exercise that actually tests it: where to look, what to emulate, what to detect, what to measure, and what to do when the exercise finds a real one
-
What a Good ICS Detection Looks Like in Practice
There is a lot of advice about ICS detection that talks about MODBUS, DNP3, and the protocol layers. This is the part that comes after the protocol talk: what a good detection actually looks like in the SIEM, and what the SOC analyst does with it
-
How to Build an Insider-Risk Programme That Actually Catches the Bad Cases
Most insider-risk programmes are aimed at the wrong target. The detection engineering is theatre. The behavioural analytics are noise. The case management is a black hole. Here is how to build a programme that finds the cases that actually matter
-
The Detection Rule That Changed How I Think About Fidelity
There is one detection rule in my career that genuinely changed how I think about detection fidelity. It was not a clever rule. It was a simple rule. The simplicity is what taught me the most. Here is the rule and what it taught me
-
How to Hire a Detection Engineer When You Have Never Hired One Before
Most detection engineer hiring fails because the job description is wrong. Here is what to actually look for, what to test in the interview, and the most common mistakes programmes make on the first hire
-
The Six-Month Build: What a Real Detection Engineering Programme Looks Like
Most 'detection engineering programmes' are not programmes. They are a person with a Sigma rule and a prayer. Here is what a real six-month build looks like, in order, and what each phase actually costs
-
What a Good Detection Engineer Actually Does All Day
The job description for a detection engineer reads like a software engineer with a security focus. The actual job is more like an editor at a small newspaper. Here is what the work looks like when the title is right and the work is also right
-
Building a Detection Baseline: The Work Nobody Wants to Do
Every detection engineer has been told to build a baseline. Almost nobody has been given a clear answer about what a baseline actually is, what data it needs, or how it connects to the rules the SOC actually runs. Here is the honest version of the work
-
Purple Teaming at Scale: How It Changes When You Have 20 Blue Team Analysts
Most purple team advice is written for a team of three. If you scale to twenty, the bottlenecks move, the failure modes change, and the programme either matures or quietly dies on contact with reality. Here is what shifts, and what does not
-
Living Off the Land: Why the Best Attackers Don't Look Like Attackers
Volt Typhoon maintained access to critical infrastructure networks in the United States for at least five years. Microsoft, Mandiant, and the Five Eyes governments published the technical details in 2024. The…
-
The Insider Threat Problem Is Not What You Think
Your insider threat programme is aimed at the wrong target