- Home
- Insights
Insights
Field notes from
the incident floor.
Regulation, readiness and risk, written by the people who work the incidents. For daily threat research, detection packs and case files, see the intelligence blog.
DFIR · Compliance · 1 May 2026 · 5 min
What 600+ Engagements Taught Me About the Gap Between Your Policy and Your Breach
18 years and 600+ engagements show it is rarely the policy that fails. It is the gap between a document and a capability. What B-13 and the CCSPA demand.
Read →Regulation · Compliance · 1 April 2026 · 6 minThe CCSPA's 90-Day Clock Hasn't Started. That's Exactly Why You Should Start Now
The CCSPA, enacted by Bill C-8, is law but not yet in force. Once designated, operators get 90 days to stand up a cyber security program. Start now.
Read →Fintech · Strategy · 23 March 2026 · 6 minThe Fintech Fortress: Why Your Growth Strategy Is Only As Strong As Your Security Posture
Why fintech security posture must evolve as fast as the product roadmap. API abuse, supply-chain compromise and data sovereignty, from the incident floor.
Read →From the intelligence blog
Latest threat research.
Incident Response · 12 Oct 2026
Case #119: The CEO Who Never Called
Read on the intelligence blog →Detection · 11 Oct 2026Detecting Initial Access Broker Footholds Before the Handoff
Read on the intelligence blog →Detection · 11 Oct 2026Detecting LSASS Credential Dumping as a Ransomware Precursor
Read on the intelligence blog →Detection · 11 Oct 2026Detecting Backup Deletion and Tampering Before Ransomware
Read on the intelligence blog →Detection · 11 Oct 2026Detecting GPO-Based Mass Payload Deployment
Read on the intelligence blog →Detection · 11 Oct 2026Detecting Mass PsExec and WMI Fan-Out Deployment
Read on the intelligence blog →Want these in your inbox?
Ask to join the briefing list and we will send new insights and threat research as they publish.