Skip to content
Cyber Security Firms

Cyber security resources

Every article on the site, grouped by topic. Each one answers a single question completely, so you are not stitching an answer together from four half-pages.

100 resources across 7 topics

Cyber Security BasicsThreats ExplainedDefenses and ToolsProtect YourselfCyber Security for BusinessCompliance and RegulationCareers and Certifications
Cyber Security Basics

3 resources

What Is Cyber Security? The Plain-English Guide
Beginner

What Is Cyber Security? The Plain-English Guide

Every definition of cyber security you have read is technically right and practically useless. Here is what the field actually does, what it is up against, and what any of it means for you.

13 min read
Cyber Security Basics: The Beginner's Starting Point
Beginner

Cyber Security Basics: The Beginner's Starting Point

The hard part of starting is not that any one idea is difficult. It is that nobody tells you which of the hundred things you have read is the one to do first.

20 min read
Cyber Security Terms: 92 Definitions in Plain English
Beginner

Cyber Security Terms: 92 Definitions in Plain English

Most cyber security writing assumes you already have the vocabulary. This is the vocabulary, grouped by what each word does rather than by first letter, so the words arrive in an order that makes sense.

31 min read
Threats Explained

14 resources

Cyber Security Threats: The 12 That Actually Cause Breaches
Beginner

Cyber Security Threats: The 12 That Actually Cause Breaches

Every list of cyber threats has twenty entries and no sense of proportion. These are the twelve that account for nearly all real breaches, in the order the evidence ranks them, with the mechanism of each drawn out.

13 min read
Business Email Compromise: How It Works and How to Stop It
Beginner

Business Email Compromise: How It Works and How to Stop It

Business email compromise is the fraud that arrives with no malware, no link and no obvious lie: a real invoice from a real supplier, with the bank details changed. It is the second most expensive crime reported to the FBI.

18 min read
Credential Stuffing: How the Attack Works and How to Stop It
Beginner

Credential Stuffing: How the Attack Works and How to Stop It

Credential stuffing does not guess your password. It already has one, taken from a site you forgot you signed up for, and it is trying that exact password everywhere else you might have used it.

12 min read
Insider Threat: Definition, Types, Examples and Controls
Beginner

Insider Threat: Definition, Types, Examples and Controls

An insider threat is not a kind of person you can pick out of a room. It is a piece of access doing something it was never meant to do, and most of the time nobody involved meant any harm at all.

16 min read
What Is a Data Breach? How They Happen and How to Check
Beginner

What Is a Data Breach? How They Happen and How to Check

A data breach is an event about data, not about damage, and the two get confused constantly. Here is what the word actually covers, how one unfolds, and where to look to find out whether your information is already in one.

19 min read
What Is a DDoS Attack? How It Works and How to Stop It
Beginner

What Is a DDoS Attack? How It Works and How to Stop It

A DDoS attack does not break into anything. It buries a website in traffic until nobody else can reach it, and the defense has to sit upstream of the thing being buried.

15 min read
What Is a Man-in-the-Middle Attack? Types and Signs
Beginner

What Is a Man-in-the-Middle Attack? Types and Signs

The version everyone pictures, a stranger reading your email over the cafe Wi-Fi, mostly stopped working. The idea underneath it moved to the login page, where it works better than ever.

11 min read
What Is a Zero Day? Vulnerabilities, Exploits, Attacks
Beginner

What Is a Zero Day? Vulnerabilities, Exploits, Attacks

Zero day is three different things wearing one name, and the difference decides what you can do about it. Here is what the clock is counting, how many are really out there, and what protects a system that has no patch available.

14 min read
What Is Malware? Types, Signs and How to Remove It
Beginner

What Is Malware? Types, Signs and How to Remove It

Malware is not one attack, it is the whole category, which is why the word feels vague right up until something on your machine starts behaving oddly. Here is what it covers, how it arrives, and what actually gets it off.

18 min read
What Is Phishing? How It Works and How to Spot It
Beginner

What Is Phishing? How It Works and How to Spot It

Phishing is the attack everyone has seen and most people still fall for, because the good ones do not look like the bad ones. Here is how it works, what gives it away, and what to do when you have already clicked.

10 min read
What Is Ransomware? How It Works and How to Stop It
Beginner

What Is Ransomware? How It Works and How to Stop It

The ransom note is the last thing that happens, not the first. By the time it appears the attackers have usually been inside for days, taken a copy of everything worth taking, and deleted the backups. The week before the note is where this is won or lost.

16 min read
What Is Social Engineering? How These Attacks Work
Beginner

What Is Social Engineering? How These Attacks Work

Social engineering is the attack that never touches your software, because it does not have to. It asks a person, politely and plausibly, and the person says yes.

15 min read
What Is a Supply Chain Attack? Examples and Defenses
Intermediate

What Is a Supply Chain Attack? Examples and Defenses

A supply chain attack does not start with you. It starts with a company you bought something from, and it arrives signed, expected and trusted.

17 min read
What Is SQL Injection? How It Works and How to Stop It
Intermediate

What Is SQL Injection? How It Works and How to Stop It

SQL injection turns a form field into an instruction the database obeys. It is one of the oldest flaws on the web, second on the latest list of the most dangerous software weaknesses, and one of the very few problems in security with a complete fix.

18 min read
Defenses and Tools

22 resources

How to Create a Strong Password That Actually Holds Up
Beginner

How to Create a Strong Password That Actually Holds Up

Most password advice is a decade out of date. The rules that replaced it are shorter, easier to follow, and written down in a federal standard you can check.

14 min read
Two-Factor Authentication: How 2FA Works and Which to Use
Beginner

Two-Factor Authentication: How 2FA Works and Which to Use

A password is one secret, and secrets travel. Two-factor authentication adds a second proof that whoever stole the first one does not have, and which kind of second factor you pick matters more than anyone tells you.

14 min read
What Is a Firewall? How It Works and What It Misses
Beginner

What Is a Firewall? How It Works and What It Misses

A firewall decides which network traffic gets through and which does not. That is a narrower job than most people assume, and knowing exactly where the line falls is what tells you which other defenses you still need.

14 min read
What Is a Password Manager? How It Works and the Catch
Beginner

What Is a Password Manager? How It Works and the Catch

A password manager is an encrypted vault that invents a different password for every account and types it for you. The reason to use one is arithmetic, and the reasons not to are worth hearing before you commit.

20 min read
What Is Encryption? How It Works and the Two Types
Beginner

What Is Encryption? How It Works and the Two Types

Encryption is running on almost everything you touch, and the only decision that ever matters is who holds the key. Here is how it works, what the two types are for, and where it quietly stops protecting you.

13 min read
EDR vs Antivirus: What Is Different and Which You Need
Intermediate

EDR vs Antivirus: What Is Different and Which You Need

Antivirus asks whether a file is known to be bad. EDR asks whether the last twenty minutes on this machine look like an attack. Almost every company ends up running both, and the interesting question is which one you are actually paying for.

15 min read
Penetration Test vs Vulnerability Scan: Which to Buy
Intermediate

Penetration Test vs Vulnerability Scan: Which to Buy

One of these is a tool run against everything you own. The other is a person working against a few things you named. The quotes differ by a factor of twenty because the products differ by more than that, and most buyers are comparing them as if they were the same purchase in two sizes.

18 min read
SIEM vs SOAR: What Each One Does and Which You Need
Intermediate

SIEM vs SOAR: What Each One Does and Which You Need

A SIEM decides that something is happening. A SOAR does something about it. They are quoted side by side as though a buyer picks one, and that framing is what leads companies to spend six figures on the wrong half first.

19 min read
VPN vs Zero Trust: The Differences and Which You Need
Intermediate

VPN vs Zero Trust: The Differences and Which You Need

A VPN proves you are allowed onto the network. Zero trust asks, every time, whether you should reach the one thing you are asking for. Most companies end up running both, and the money is in knowing which jobs to move first.

19 min read
What Is a SOC? Inside a Security Operations Center
Intermediate

What Is a SOC? Inside a Security Operations Center

A security operations center is the team that answers the alert, not the software that raised it. The distinction decides almost everything about what one costs and whether yours works.

14 min read
What Is Application Security? Scope, Risks and Tools
Intermediate

What Is Application Security? Scope, Risks and Tools

Application security is the one domain where the people holding the fix are developers rather than the security team. Knowing where its edges sit is what stops a company buying a scanner and assuming the software problem went with it.

18 min read
What Is Cloud Security? Risks, Controls and Owners
Intermediate

What Is Cloud Security? Risks, Controls and Owners

Moving to the cloud moved the hardware. It did not move the responsibility, and the half that stayed with you is the half that gets breached.

16 min read
What Is EDR? Endpoint Detection and Response Explained
Intermediate

What Is EDR? Endpoint Detection and Response Explained

An EDR agent watches every process that starts on a laptop or a server, keeps the record, and can cut the machine off the network. The part nobody sells you is that someone still has to read what it finds.

16 min read
What Is Email Security? Controls, Threats and Gaps
Intermediate

What Is Email Security? Controls, Threats and Gaps

Email security is the one domain every employee touches daily, and the only system a company runs that accepts unsolicited input from strangers by design. Knowing where its edges sit is what stops a company buying a filter and assuming the problem left with it.

20 min read
What Is Endpoint Security? Controls, Tools and Gaps
Intermediate

What Is Endpoint Security? Controls, Tools and Gaps

Endpoint security is the part of the field that lives on the devices people actually work on. Knowing where its edges sit is what stops a company buying an agent and assuming the rest of the problem went with it.

15 min read
What Is Network Security? Controls, Threats and Gaps
Intermediate

What Is Network Security? Controls, Threats and Gaps

Network security is the part of the field that governs what may reach what. The firewall at the boundary is the famous piece, and it is also the piece attackers now go after first.

16 min read
What Is Penetration Testing? The Phases, Types and Limits
Intermediate

What Is Penetration Testing? The Phases, Types and Limits

A penetration test is an authorized attack on your own systems, run by someone you pay to succeed. What varies enormously is the scope, the skill and what you get back, which is why three quotes for the same request arrive at three prices.

13 min read
What Is SIEM? How Log Data Becomes a Security Alert
Intermediate

What Is SIEM? How Log Data Becomes a Security Alert

Every system you run is already writing down what it did. A SIEM is the product that reads all of it at once and tells you which three lines out of nine million belong together.

15 min read
What Is Vulnerability Scanning? Types and How It Works
Intermediate

What Is Vulnerability Scanning? Types and How It Works

A vulnerability scan tells you what is wrong with your systems in a few hours. Working out which of the four hundred findings an attacker would actually use is the part that decides whether the scan was worth running.

16 min read
What Is Zero Trust? The Principles, Pillars and Limits
Intermediate

What Is Zero Trust? The Principles, Pillars and Limits

Zero trust is a set of design principles, not a category of software, and the distance between those two things is where most security budgets go wrong. Here is what the model actually says, who defines it, and what it does not solve.

12 min read
XDR vs EDR: What Each One Sees and Which You Should Buy
Intermediate

XDR vs EDR: What Each One Sees and Which You Should Buy

EDR knows one machine in extraordinary detail. XDR knows a little about the endpoint, the identity system, the mailbox and the cloud tenant, and joins them into one story. The choice is usually about how many consoles you want, not about which product detects more.

17 min read
Red Team vs Penetration Test: What Differs and Which to Buy
Advanced

Red Team vs Penetration Test: What Differs and Which to Buy

A penetration test asks which of your systems can be broken into. A red team asks whether anyone would notice. They are priced differently because they are measuring different things, and a company that buys the wrong one gets a real answer to a question it was not asking.

17 min read
Protect Yourself

4 resources

What to Do After a Data Breach: A Step-by-Step Plan
Beginner

What to Do After a Data Breach: A Step-by-Step Plan

A breach notice tells you something happened and very little about what to do. The right response depends on exactly what was exposed, and most of it takes an hour.

11 min read
How to Freeze Your Credit at All 3 Bureaus for Free
Beginner

How to Freeze Your Credit at All 3 Bureaus for Free

A freeze stops anyone opening a new credit account in your name, costs nothing, and does not touch your credit score. The catch is that you have to do it three times.

13 min read
How to Know If You Have Been Hacked: Signs and Checks
Beginner

How to Know If You Have Been Hacked: Signs and Checks

Most of the signs people worry about have innocent explanations, and the ones that matter are sitting in a settings page nobody opens. Here is what to look at, in what order, and what each answer actually proves.

13 min read
How to Spot a Phishing Email: 7 Red Flags to Check
Beginner

How to Spot a Phishing Email: 7 Red Flags to Check

A message is open in front of you and something about it is off. This is the check that settles it, in the order that settles it fastest, and it works on a phone.

13 min read
Cyber Security for Business

24 resources

Cyber Security for Small Business: Costs and Priorities
Beginner

Cyber Security for Small Business: Costs and Priorities

A small business does not need a security program. It needs a short list of things done properly, in a particular order, with a clear view of what each one costs before the money is committed.

17 min read
Cyber Security Consulting: What You Get and What to Ask
Beginner

Cyber Security Consulting: What You Get and What to Ask

Consulting proposals are hard to compare because each one prices a different thing. This is what the service actually covers, what it leaves out, and the questions that separate a firm that will help from one that will send a report.

18 min read
Security Awareness Training That People Do Not Ignore
Beginner

Security Awareness Training That People Do Not Ignore

Every quote promises fewer clicks. What separates a program that changes behavior from a license nobody logs into is who runs the campaigns, what happens when somebody reports a real attack, and which of the work the contract quietly leaves with you.

23 min read
Cloud Security Services for a Company With No Cloud Team
Intermediate

Cloud Security Services for a Company With No Cloud Team

Your data moved into somebody else's data center. The security work that came with it did not move anywhere, and cloud security services are what a company buys when nobody on staff can tell an over-privileged role from a normal one.

24 min read
Cyber Insurance Cost: What It Pays and What It Excludes
Intermediate

Cyber Insurance Cost: What It Pays and What It Excludes

Three of the pages ranking for this question hand you a different average, and none of them says what it is measuring. Here is where each number comes from, and which parts of a policy decide whether any of it reaches you.

17 min read
Cyber Security for Financial Services: Rules and Cost
Intermediate

Cyber Security for Financial Services: Rules and Cost

Financial services is the one sector where the security rule, the supervisor who examines you against it, and a reporting clock measured in hours all arrive together. That changes what a firm should buy, and in what order.

18 min read
Cyber Security for Healthcare: HIPAA, Threats and Cost
Intermediate

Cyber Security for Healthcare: HIPAA, Threats and Cost

Healthcare is the only sector with a federal rule naming the safeguards and a public list of everyone who lost 500 records or more. That changes what a provider should buy, and in what order.

16 min read
Cyber Security for Law Firms: Rules, Threats and Cost
Intermediate

Cyber Security for Law Firms: Rules, Threats and Cost

A law firm is the one business whose duty to protect data is written by its own profession, enforced by the authority that grants its license, and attached to every matter in the building. That changes what a firm should buy, and in what order.

17 min read
Cyber Security for Manufacturers: Rules, Risks, Costs
Intermediate

Cyber Security for Manufacturers: Rules, Risks, Costs

A manufacturer's worst day is not a leaked spreadsheet. It is a stopped line, a customer waiting on parts, and a purchase order clause nobody read closely enough.

19 min read
Cyber Security for Nonprofits: Rules, Risks and Cost
Intermediate

Cyber Security for Nonprofits: Rules, Risks and Cost

A nonprofit is exempt from most of the privacy statutes written for companies and exempt from none of the breach notification laws. That gap decides what a charity should spend money on.

17 min read
Cyber Security for Schools: FERPA, Threats and Budget
Intermediate

Cyber Security for Schools: FERPA, Threats and Budget

Schools hold the most complete identity file most children will ever have, and no federal rule tells a district how to protect it. That absence, not the threat, is what shapes the spending.

20 min read
Cyber Security Staffing: In-House vs Outsourced Teams
Intermediate

Cyber Security Staffing: In-House vs Outsourced Teams

Almost nobody actually chooses between an in-house security team and an outsourced one. The real decision is which half of the work goes where, and the half that gets forgotten is the half nobody named an owner for.

20 min read
Incident Response Cost: What a Breach Costs to Fix
Intermediate

Incident Response Cost: What a Breach Costs to Fix

Almost every hourly rate published for incident response was written by a firm that sells it, and none of them cites a survey. The measured numbers come from insurance claims, and they look nothing like the averages you have been reading.

19 min read
Incident Response Plan: How to Build One and Test It
Intermediate

Incident Response Plan: How to Build One and Test It

Most incident response plans are written for an auditor and opened for the first time at two in the morning on the night they are needed. The plan that works is the one the person on shift can follow without waking anyone to ask permission.

22 min read
Incident Response Retainer: What It Covers and What It Costs
Intermediate

Incident Response Retainer: What It Covers and What It Costs

A retainer is not a security product. It is a signed contract, a rate card and a phone number that answers at three in the morning, bought in a quiet week so none of it has to be negotiated during the worst one.

17 min read
MDR Pricing: What Managed Detection and Response Costs
Intermediate

MDR Pricing: What Managed Detection and Response Costs

Ask three providers what managed detection and response costs and you get three numbers that cannot be compared, because none of them is priced on the same unit. The published figures that do exist are worth knowing, and so is who published them.

17 min read
MSSP vs MDR: Key Differences and Which One You Need
Intermediate

MSSP vs MDR: Key Differences and Which One You Need

Two acronyms get sold to the same buyer out of the same budget, and the difference between them is not the technology. It is whether anyone at the provider is allowed to stop an attack without calling you first.

18 min read
Penetration Testing Cost: What a Pen Test Really Costs
Intermediate

Penetration Testing Cost: What a Pen Test Really Costs

Every price you will read for a penetration test was published by a company that sells penetration testing. No independent survey of what US buyers actually pay exists, so the useful skill is reading a quote rather than memorizing a number.

22 min read
Penetration Testing Services: How to Buy a Pen Test
Intermediate

Penetration Testing Services: How to Buy a Pen Test

Three firms quote three prices for what sounds like the same job, and the difference is almost never skill. It is scope, who does the testing, and what the contract says happens after the report lands.

18 min read
Vulnerability Management Services: What You Are Buying
Intermediate

Vulnerability Management Services: What You Are Buying

Every provider in this market says it manages your vulnerabilities. Almost none of them will apply a patch, and the distance between those two sentences is where most programs stall for a year.

23 min read
What Is a vCISO? Virtual CISO Services, Cost and Scope
Intermediate

What Is a vCISO? Virtual CISO Services, Cost and Scope

A vCISO is the security executive you rent instead of hire. The service works when both sides agree on what is inside it, and the disappointed engagements are almost always the ones where nobody wrote that down.

22 min read
What Is Managed Detection and Response? MDR vs MSSP
Intermediate

What Is Managed Detection and Response? MDR vs MSSP

Buying managed detection and response is buying people, not software. The question that separates two quotes at the same price is which systems the provider can see, and what they are allowed to do at three in the morning without calling you first.

21 min read
What Managed Security Services Cover, and What They Do Not
Intermediate

What Managed Security Services Cover, and What They Do Not

Every managed security quote promises 24/7 monitoring. The sentence commits nobody to anything until you know which systems are watched, who is allowed to act on what they see, and which parts of the job the contract quietly leaves with you.

20 min read
What Security Awareness Training Costs Per User in 2026
Intermediate

What Security Awareness Training Costs Per User in 2026

Two vendors publish a price list. Everybody else says contact sales, which is why almost every number attached to this question has nothing behind it. This page uses only what can be sourced to a published price or a filed contract.

23 min read
Compliance and Regulation

31 resources

Cyber Security Compliance: Frameworks and Deadlines
Beginner

Cyber Security Compliance: Frameworks and Deadlines

Compliance work usually starts with an email nobody in the company can classify: a customer asking for a report, or a regulator pointing at a rule. Which of the two you are holding decides everything that happens next.

21 min read
Audit vs Assessment vs Certification: Key Differences
Intermediate

Audit vs Assessment vs Certification: Key Differences

Three words arrive in the same procurement thread and get used as though they were one. They describe different work, done by different people, ending in documents with different shelf lives.

17 min read
Data Breach Notification Laws by State and Deadlines
Intermediate

Data Breach Notification Laws by State and Deadlines

Fifty states wrote fifty answers to the same question, and a company holding customer records in a dozen of them is holding a dozen deadlines at once. The hard part is not the number of days. It is knowing which day the counting started.

20 min read
How Long a SOC 2 Audit Takes: The Timeline by Phase
Intermediate

How Long a SOC 2 Audit Takes: The Timeline by Phase

The date procurement wants and the date a report can exist are set by two different things. One is a quarter end. The other is an observation period that has to actually elapse.

15 min read
How to Answer a Security Questionnaire, Step by Step
Intermediate

How to Answer a Security Questionnaire, Step by Step

A security questionnaire is not a form. It is a set of representations your buyer can check, your lawyers will inherit, and your next customer will compare against the last set you sent.

21 min read
How to Prepare for a SOC 2 Audit: The 9 Steps in Order
Intermediate

How to Prepare for a SOC 2 Audit: The 9 Steps in Order

The order of the work decides whether your first report comes back clean. A control switched on halfway through the observation period produces evidence for half of it and a finding for the rest.

19 min read
How to Read a SOC 2 Report: A Section by Section Guide
Intermediate

How to Read a SOC 2 Report: A Section by Section Guide

A vendor answers your security questionnaire by attaching a ninety page PDF, and procurement wants a yes or a no by Friday. The useful parts of that document are in four places, and a first pass takes about half an hour once you know where to look.

19 min read
ISO 27001 vs SOC 2: Which One Does Your Business Need?
Intermediate

ISO 27001 vs SOC 2: Which One Does Your Business Need?

One standard certifies that you run a management system. The other reports an accountant's opinion on your controls. Companies pick the wrong one because they compare the security requirements, when the answer is decided by who is asking.

17 min read
NIST Cybersecurity Framework: Functions, Tiers and Profiles
Intermediate

NIST Cybersecurity Framework: Functions, Tiers and Profiles

The framework arrives attached to an insurance form or a customer questionnaire, and the question behind it is always the same: are we obliged to do this? The answer is written into the statute that created it, and almost nobody quotes that statute.

16 min read
NYDFS Part 500 Explained: Rules, Deadlines, Penalties
Intermediate

NYDFS Part 500 Explained: Rules, Deadlines, Penalties

Part 500 is not a framework you adopt because a customer asked. It is a New York regulation, it attaches to your license rather than your address, and it names the officer who has to sign for it.

19 min read
PCI DSS Compliance: 12 Requirements, Levels and SAQs
Intermediate

PCI DSS Compliance: 12 Requirements, Levels and SAQs

PCI DSS is twelve requirements written in plain language, wrapped in machinery that almost nobody explains: four merchant levels, ten questionnaires named after letters and acronyms, and an enforcement chain that runs through your bank rather than through Visa.

22 min read
SOC 1 vs SOC 2 vs SOC 3: Which Report Do You Need?
Intermediate

SOC 1 vs SOC 2 vs SOC 3: Which Report Do You Need?

The numbers are labels, not levels. A SOC 1 is not a starter SOC 2 and a SOC 3 is not the advanced one, and picking by the number is how companies spend a year producing a report their customer never asked for.

14 min read
SOC 2 Audit Cost: What the Published Numbers Say
Intermediate

SOC 2 Audit Cost: What the Published Numbers Say

Every page that answers this question gives you a range and no source. Here is what an actual audit firm publishes, what the compliance vendors publish, and how to tell those two things apart before you write the budget.

16 min read
SOC 2 Readiness Services: What They Cover and What to Ask
Intermediate

SOC 2 Readiness Services: What They Cover and What to Ask

Readiness is the part of SOC 2 you actually shop for, and the proposals are impossible to compare because one prices a diagnosis and another prices the treatment. This is what you are buying, from who, and on what terms.

24 min read
SOC 2 Trust Services Criteria: The Five Categories
Intermediate

SOC 2 Trust Services Criteria: The Five Categories

Every SOC 2 report names the categories it was examined against, and that one line decides what the report cost and how much a buyer should read into it. The five categories are not a menu of equal options.

14 min read
SOC 2 Type 1 vs Type 2: Which Report Do You Need?
Intermediate

SOC 2 Type 1 vs Type 2: Which Report Do You Need?

Both reports come from the same auditor, cover the same criteria and carry the same logo. One of them says your controls were designed properly on a Tuesday. The other says they ran every day for months, and that difference is the whole product.

17 min read
The FTC Safeguards Rule, Explained: Elements and Fines
Intermediate

The FTC Safeguards Rule, Explained: Elements and Fines

A federal data security rule with named technical controls applies to tax preparers, auto dealers and mortgage brokers, and most of them find out from a customer questionnaire rather than from the FTC.

16 min read
The HIPAA Security Rule, Explained: Safeguards and Fines
Intermediate

The HIPAA Security Rule, Explained: Safeguards and Fines

The Security Rule is the only federal cyber security regulation that names its safeguards in statutory text. It is also the one people most often describe from memory, wrongly, right up until the Office for Civil Rights asks to see the paperwork.

24 min read
The SEC Cyber Disclosure Rules: Item 1.05 and Item 106
Intermediate

The SEC Cyber Disclosure Rules: Item 1.05 and Item 106

The four business day deadline everyone quotes does not run from the day you were breached. It runs from a judgment call your own company makes, which is why the rule is harder to comply with than it is to summarize.

16 min read
Vendor Risk Management, Explained: Rules and Process
Intermediate

Vendor Risk Management, Explained: Rules and Process

Nearly half of breaches now arrive through somebody else's company. Vendor risk management is the program that decides which of those companies you let near your data, and four separate US regimes tell you, in numbered paragraphs, what that program has to contain.

21 min read
What Compliance Automation Platforms Do (and Do Not)
Intermediate

What Compliance Automation Platforms Do (and Do Not)

A compliance automation platform turns a quarterly scramble for screenshots into a dashboard that is always on. It also creates a new dependency, and it cannot sign the thing a regulator asks a named person to sign.

19 min read
What Is a Security Audit? What One Actually Involves
Intermediate

What Is a Security Audit? What One Actually Involves

An audit is not a scan, a questionnaire or a consultant's opinion. It is an independent examination against criteria fixed before anyone arrives, and knowing that changes what you buy and what you can hand a customer.

16 min read
What Is a SOC 2 Bridge Letter, and When You Need One
Intermediate

What Is a SOC 2 Bridge Letter, and When You Need One

A bridge letter is the document that covers the months your SOC 2 report does not. It is written by your own management, signed by nobody independent, and worth exactly as much as the sentence in it that says nothing material changed.

16 min read
What Is CMMC? The Levels, Requirements and Deadlines
Intermediate

What Is CMMC? The Levels, Requirements and Deadlines

A CMMC level arrives in a solicitation or a flow-down clause with the number already chosen for you. The work is figuring out which one you were handed, what the rule requires at that level, and how long you have.

20 min read
What Is FedRAMP? Impact Levels, Costs and 20x Rules
Intermediate

What Is FedRAMP? Impact Levels, Costs and 20x Rules

An agency buyer says the purchase cannot happen without FedRAMP, and most of what is published about the program describes rules that were replaced in June 2026.

19 min read
What Is GDPR and When Does It Apply to US Companies?
Intermediate

What Is GDPR and When Does It Apply to US Companies?

A US company can fall under GDPR without ever opening an office in Europe, and the clause that does it is one sentence long. Most American businesses meet the rest of the regulation during an incident rather than before one.

21 min read
What Is HITRUST? Certification, Costs and Assessments
Intermediate

What Is HITRUST? Certification, Costs and Assessments

A health plan's vendor risk team asks for HITRUST certification and names a tier you have never heard of. The letters come from a private company, not a regulator, and that single fact explains most of what follows.

13 min read
What Is ISO 27001? Requirements and Certification
Intermediate

What Is ISO 27001? Requirements and Certification

A customer asks whether you are certified to ISO 27001, and the honest answer turns on a distinction most vendors never make: the standard describes a management system, and the certificate is an optional purchase on top of it.

17 min read
What Is NIST SP 800-171? Requirements and Who It Binds
Intermediate

What Is NIST SP 800-171? Requirements and Who It Binds

NIST SP 800-171 is a free public document that binds nobody on its own. A contract clause makes it binding, and the clause and the publication do not always point at the same version.

18 min read
What Is SOC 2 Compliance? Criteria, Types and Audits
Intermediate

What Is SOC 2 Compliance? Criteria, Types and Audits

SOC 2 is the report enterprise buyers ask for before they will hand you their data. It is an accountant's opinion on your controls, not a certificate, and understanding that difference is what tells you how much one is worth.

16 min read
What Is the CCPA? Requirements, Rights and Penalties
Intermediate

What Is the CCPA? Requirements, Rights and Penalties

The CCPA does not care what industry you are in or whether you have an office in California. It cares about three numbers, and if you cross one of them the whole statute lands on you at once.

15 min read
Careers and Certifications

2 resources

Cyber Security Certifications: What Employers Ask For
Beginner

Cyber Security Certifications: What Employers Ask For

Every certification body ranks its own credential first. This is the same eight certifications laid out side by side, with what each one costs, what it demands before you can hold it, and which jobs actually ask for it.

12 min read
How to Get into Cyber Security: The Honest Route
Beginner

How to Get into Cyber Security: The Honest Route

Getting into cyber security is a sequence of moves, and most of the advice online gets the order wrong by putting a certification first. Here is the route, with the part about entry level hiring that the ads leave out.

18 min read