Skip to main content
CavemenTechSecurity Services

Insights

Practical security writing.

Notes on how security operations, detection and offensive testing actually work — written for people who have to make decisions, not for search engines.

Topics

  • SOC & MDR
  • Threat Detection
  • Active Directory Security
  • Penetration Testing
  • Cloud Security
  • Incident Response
  • Compliance
  • Cybersecurity Strategy

Published articles

SOC & MDR

Why SIEM Alerts Alone Don't Create a SOC

A SIEM produces alerts. A SOC produces decisions. The distance between the two is where most security programmes quietly fail.

6 min read

Active Directory Security

5 Active Directory Attack Paths Organizations Miss

Domain compromise rarely starts with an exploit. It usually starts with a permission somebody granted years ago and nobody has reviewed since.

8 min read

SOC & MDR

What Does a Managed SOC Actually Do?

A plain-language walkthrough of what happens between a security event occurring in your environment and someone telling you about it.

7 min read

Penetration Testing

Penetration Testing vs Vulnerability Assessment

They are commonly sold as the same thing and priced very differently. Here is what actually separates them, and when each is the right choice.

5 min read

Cybersecurity Strategy

How to Build a Security Monitoring Strategy

Start from the attacks you actually need to detect, not from the log sources you happen to have available.

7 min read

In progress

Topics currently being written. These are listed rather than linked — we don't publish placeholder pages.

  • Threat Detection

    Detecting Identity Attacks in Microsoft 365

    Most intrusions into mid-market organisations begin with an identity, not an exploit. Here is what to watch.

  • Incident Response

    The First Hour of an Incident

    What to do, what to avoid, and which decisions made in the first sixty minutes determine how the rest of the response goes.

  • Cloud Security

    Cloud Attack Paths Start With Identity

    Why cloud compromise is usually a permissions problem, and how to assess it before it becomes an incident.

  • Compliance

    ISO 27001 Readiness: What to Expect

    A realistic view of the work involved between deciding to certify and being ready for an external audit.

Next step

Prefer a conversation to an article?

If something here maps to a problem you're actually facing, a scoping call will get you further than another blog post.

Request a Security AssessmentTalk to a Security Expert