The security decisions a solo founder is already making
A one-person product team is already making security decisions. Which ones are expensive to reverse, and what senior technical review looks like at that size.
Read articleNotes from the work
Practical thinking for difficult security decisions.
We write about the questions that come up in real advisory work: how to read a pentest report, when to challenge a design and which type of security support a growing team actually needs.
Latest articles
What we have been writing about
How to scope a penetration test that is worth the cost
A practical guide to scoping a penetration test: setting objectives, defining targets, agreeing rules of engagement and choosing a provider that delivers value.
Read articleIncident readiness without a dedicated security team
How small teams can prepare for a security incident: roles, detection, a simple response sequence, backups and who to call, including Malaysia's Cyber999.
Read articleWhat the PDPA changes actually mean for a small software team
A plain-language guide to Malaysia's PDPA for software teams: what the 2024 amendment changed, breach notification, DPO duties and where to start.
Read articleHow to triage a pentest report without getting lost
Learn how to validate, prioritise and assign pentest findings, build a remediation plan and verify fixes without chasing severity labels.
Read articleWhy software houses need security advisory before the pentest
Learn how pre-pentest security advisory helps software teams fix architecture, API, cloud and CI/CD risks before independent testing.
Read articlevCISO vs technical cyber security advisor: what SMEs actually need
Compare vCISO and technical security advisory services for SMEs, including responsibilities, deliverables and when you need each.
Read article