Cyber Essentials
The UK baseline, then the controls that trip people up: identity, patching, and what an assessor actually tests.
Cyber Essentials and Cyber Essentials Plus: what it takes to pass in 2026 →Loading page
Notes
Technical articles and notes on security, Microsoft 365 and infrastructure. Press / to search titles, excerpts, and labels.
37 posts
The UK baseline, then the controls that trip people up: identity, patching, and what an assessor actually tests.
Cyber Essentials and Cyber Essentials Plus: what it takes to pass in 2026 →Win11 rollout, Win32 packaging, profile cleanup, LAPS, and shipping a VPN client with Entra.
Intune rollout checklist for Windows 11 →Conditional Access patterns, ITDR, shared local admin, and treating DNS as a control.
Conditional access patterns that survive real users →Lab on Proxmox, Azure HA, and deploying Sophos Connect with an Entra provisioning file.
Running Sophos Firewall on Proxmox: what works well in the lab →Latest
· 12 min read
What to buy for a house that stays smart when the cloud drops, which Home Assistant integrations actually repay the setup, and how to use AI to draft Lovelace dashboards without handing it the keys.
· 5 min read
MacBooks win the unplugged workday because Apple Silicon is an ARM-based SoC built for efficiency, not a classic x86 PC stack. Here is how RISC vs CISC, efficiency cores, and chip packaging decide battery life.
· 7 min read
Rust closes memory-safety holes that C and C++ leave open, Discord proved the performance and RAM wins on the backend and desktop client, and AI now makes serious ports far more practical.
· 5 min read
Technical skill gets you in the room, trust wins the deal. A short, research backed guide to better discovery, tighter demos, proofs of concept with a finish line, and the habits that make buyers want you on the call.
· 11 min read
Boards do not need the technology, they need the business impact, an honest sense of likelihood, and a decision to make. How to translate technical findings into scenarios, report measures that matter, and write a board paper that gets a decision.
· 15 min read
Phishing kits are subscription products with panels, cloaking and token capture. This is how one is built, then how QR code phishing, device code phishing and fake CAPTCHA ClickFix attacks work, and what actually stops each of them.
· 16 min read
A walkthrough of the five Cyber Essentials controls, what changed in April 2026 (MFA and 14-day patching are now auto-fail), how scope works, and exactly what an assessor tests in a Cyber Essentials Plus audit.
· 15 min read
A shared local admin password turns one compromised workstation into every workstation. This is how pass the hash lateral movement works, why shared credentials survive in so many estates, and how to migrate to Windows LAPS with Intune and Entra without breaking things.
· 4 min read
A hacking demo at a gaming festival got me excited about cyber security and made me want to work for GCHQ. Underneath it was something simpler: I love knowing how things work, and I am a deeply curious person.
· 14 min read
Feeds are built to keep you looking, not to leave you feeling good. This is how algorithms feed addiction, anxiety and fixation, what the research does and does not say, and the layers of ad blocking, tracker blocking, DNS filtering and feed removal that put the choice back in your hands.
· 19 min read
Where Tesla Robotaxi and Waymo really stand in the US, what Tesla plans next, how Optimus could charge and clean Cybercabs, and a back-of-the-envelope look at what a European robotaxi business could be worth if the regulation ever lets it in.
· 3 min read
A short tour of the microservice stack: edge, gateway, identity, compute, messaging, data, secrets, and observability, with the AWS and Azure service for each, and why modular beats the traditional monolith.
· 11 min read
Reused, memorable passwords are how most people get compromised, and the fix is not trying harder. A password manager handles the long tail, passkeys remove the shared secret altogether, and together they are easier than what they replace.
· 22 min read
Water, rail, the grid and broadband are natural monopolies, and the real question is how to own or regulate the network. Gas and electric bills are mostly set by global wholesale prices and the wires, not supplier profit. A sourced look at costs, energy price reform, the cost of living, tax, post-COVID debt at £3 trillion, and how to make state ownership actually work.
· 21 min read
The UK government has told households to hold three days of water, food and essentials. Is it just storms and power cuts, or is there more to it? What to keep in the house if the power goes off, how to cook without electricity, and what to do in a worse-case scenario.
· 15 min read
The .pro file points Sophos Connect at the VPN portal. Intune installs the MSI and copies that file into the Windows import folder. Jamf installs the Mac pkg and opens the same file for the logged-in user. SFOS 23 is still an external EAP.
· 15 min read
Remote work pushed the working day into SaaS. The data leaves by paste, upload, and a password typed into the wrong page. That is the job of an enterprise browser, including Sophos Workspace Protection and Island.
· 8 min read
Old School RuneScape goes back to shipped features, admits mistakes, and fixes friction on feedback. The rest of the software industry, and especially cyber security, should do the same, because in security a usability defect is a security defect.
· 27 min read
What to consider before you build a homelab, what to run on it, and how it ties into Home Assistant, Jellyfin, a Tesla, and an eventual off-grid setup. Real power costs, current tooling, and a phased plan.
· 8 min read
Default-deny outbound for servers, give workstations only the network paths they need, isolate management planes, and apply the same least-privilege instinct to identity, DNS, backups, and logging.
· 7 min read
DC-as-DNS blinds the firewall, fakes compromise alerts, and turns a directory outage into “the internet is down”. Put the firewall in front: external names to Cloudflare or Google, internal AD zones forwarded to the DCs.
· 25 min read
Prevention will not stop every attack. Cyber resilience is whether you keep operating, recover safely and learn. What it should look like in practice, twelve measures grounded in 2026 data and NCSC, NIST and CISA guidance, and a 30, 90 and 365 day plan.
· 6 min read
Intimate predators and nation-state algorithms use the same levers: intermittent reward, threat cycling, shame, and isolation. The goal is dysregulation, not debate.
· 12 min read
Living off the land, dual-use RMM tools, trusted tunnels, and valid credentials put attackers in a grey zone where nothing looks malicious. Prevention narrows the door. Managed detection and response is what resolves the ambiguity at 2am.
· 7 min read
A compelling case for containerisation: faster experiments, image hubs, sane updates, honest trade-offs, real scale, and why containers are perfect for home labs.
· 6 min read
From Arup's deepfake boardroom to Ferrari's near miss, DPRK hiring deepfakes, and voice-clone family scams: what AI-enabled attacks look like in the real world, and what actually stops them.
· 9 min read
Attackers are logging in as your users through AiTM phishing, social engineering, RDS, portals, and mailboxes. Prevention still matters. Identity threat detection and response is what catches what gets through.
· 4 min read
Why a computer startup script that uses Win32_UserProfile often beats the built-in GPO that deletes profiles older than X days on restart.
· 3 min read
Azure HA for Sophos is not the same as plugging two appliances into the same LAN. Use Azure Load Balancer with health probes, then align policy across nodes with Sophos Central—because you are orchestrating two independent firewalls, not one clustered brain.
· 2 min read
Stand up Sophos Firewall (SFOS) as a VM on Proxmox for proof-of-concept or lab: images, NICs, resources, and a few pitfalls before you mirror the same design in production hardware.
· 5 min read
Split Main, Guest, and IoT networks on a UDM Pro, keep IoT off your trusted LAN, and allow Chromecast and AirPlay from phones and laptops without flattening security.
· 2 min read
Use Microsoft’s Win32 Content Prep Tool to wrap your installer folder into an .intunewin, then publish a Win32 app with silent install and detection.
· 1 min read
Structuring Entra ID policies so security improves without endless exclusions.
· 1 min read
A practical order of operations before you flip enforcement policies.
· 1 min read
Why quarterly test restores beat a perfect backup policy on paper.
· 1 min read
Constrained language, logging, and approval flows for high-privilege sessions.
· 1 min read
Split-horizon, logging, and filtering without turning your helpdesk into a ticket factory.