A 200 response is not your proof
How to choose a final check that shows whether the protected state really changed.
Writing
Notes from the practice.
Short articles on planning tests, diagnosing control failures and reporting what the evidence actually supports. Sources are listed at the end of each note.
All notes
Published 25 August 2026 · no registration or download form
Turning threat reporting into a test plan
A practical way to move from reporting and ATT&CK references to a short, testable exercise.
When the alert never arrives: check the chain
A step-by-step diagnosis from controlled activity to a responder’s decision.
Attack-path diagrams: test the arrows
How to turn a busy attack-path graph into a small set of checks and useful choke points.
Rules of engagement I want open during a test
What to put in the working document for authority, scope, budgets, communications and stops.
Exercises