Thinking on cybersecurity, compliance, and managed defence - from the CyberCheck team.
Software Bills of Materials have gone from a niche compliance artifact to something regulators and enterprise customers increasingly require by name, and that rapid mandate-driven adoption has outpaced a clear, shared understanding of what an SBOM actually tells you — and, just as importantly, what it structurally can’t. What an SBOM Genuinely Solves An SBOM’s … Read more
Identity and access management programs get evaluated heavily on how well provisioning works — how quickly and correctly a new employee gets access to what they need — while deprovisioning, the reverse process of removing access when it’s no longer needed, receives disproportionately less attention despite being where most real IAM program failures actually originate. … Read more
Zero trust has become one of the most overused terms in security marketing, applied to products that implement a narrow slice of the actual architecture while the phrase itself gets stretched to cover almost any access control improvement. Underneath the marketing noise, though, is a genuinely coherent architectural model with specific, identifiable requirements — and … Read more
“Should we get a penetration test or a red team engagement” is a question worth answering deliberately, because the two assessments measure genuinely different things, and buying the wrong one for an organization’s actual security maturity produces a report that either states the obvious or misses the point entirely. What a Penetration Test Actually Measures … Read more
Enabling encryption at rest for etcd is a genuinely important Kubernetes security control, and it’s also frequently treated as a complete solution to Kubernetes secrets security when it addresses only one specific threat: someone gaining direct access to the etcd data store or its underlying disk. Most real-world Kubernetes secrets exposure happens through paths that … Read more
Organizations preparing for a first SOC 2 audit consistently underestimate one thing: not the technical controls themselves, which most reasonably mature companies already have in some form, but the evidence trail proving those controls operated consistently over the entire audit period. A control that exists but wasn’t documented as operating is, from an auditor’s perspective, … Read more
Cloud Security Posture Management tools get sold on the promise of catching cloud misconfigurations automatically, and they genuinely do catch a real and important category of risk — but “catches misconfigurations” covers a wide range of actual capability, and teams that buy a CSPM tool expecting comprehensive cloud security coverage are usually disappointed by what … Read more
Every codebase accumulates more credentials than anyone tracking access controls believes it has, and the gap between “credentials we know about” and “credentials that actually exist and work” is what security teams call secrets sprawl — a problem that grows quietly with every API integration, every CI pipeline, and every developer who hardcodes a token … Read more
Tabletop exercises are structured, discussion-based simulations that walk a team through a hypothetical security incident. They deliver real incident response practice at a fraction of the cost and disruption of a full technical simulation, yet most organizations still underuse them relative to their actual value. What a Tabletop Exercise Involves A tabletop exercise gathers the … Read more
Kubernetes admission controllers give teams a powerful mechanism for enforcing security and operational policy before resources are ever created in a cluster. Yet many organizations underuse this capability. They rely instead on after-the-fact detection and remediation for violations that admission control could have prevented entirely. What Admission Controllers Do Admission controllers intercept requests to the … Read more