Practice, at length.
A Speak to It™ term tells you what something is. This is where the same subject is worked through properly: what good looks like, what to require, how to evidence it, and where most teams get it wrong.
289 written, 1405 more commissioned. Free to read, because a common professional vocabulary should not depend on ability to pay.
API Identity Misuse
The Application Is Decommissioned. The API Key Still Works. Somebody Else Is Using It.
7 min read · 14 Sep 2026
Access Certification Effectiveness
100% Completion Rate. 11.7 Seconds Per Account. The Review Was a Checkbox.
6 min read · 11 Sep 2026
Access Policy Misconfigurations
The Policy Was Correct at Deployment. The System It Governs Changed. The Policy Did Not.
6 min read · 9 Sep 2026
Alert Fatigue Across Ecosystems
Twelve Hundred Alerts. Forty-Five Seconds Each. Critical Indicator: Alert 1173.
5 min read · 6 Sep 2026
Alert Prioritisation Gaps
Static Medium Priority. Current Context: Primary TTP of Active Threat Actor. Four-Hour Review Queue.
6 min read · 4 Sep 2026
Attack Dwell Time via Vendors
Forty-Eight Days Across Three Organisations. Customer Data Was the Final Target.
5 min read · 1 Sep 2026
Authentication vs Authorization Confusion
Authentication Confirmed Identity. Authorization Determines What They Can Do.
6 min read · 30 Aug 2026
Vendor Backup Storage Exposure
The Copy of Your Data That Nobody Assessed
10 min read · 27 Aug 2026
Breach Attribution Challenges
Three Hypotheses. All Consistent With Evidence. Attribution May Never Be Definitive.
5 min read · 25 Aug 2026
Breach Simulation Gaps
Simulation: Scripted Scenario. Real Breach: Unknown Scenario, Uncooperating Attacker, Uncertain Detection.
5 min read · 22 Aug 2026
Cloud Security
Vendor Access, Misconfigurations, and the Risk You Invited In
7 min read · 20 Aug 2026
Conditional Access Gaps
Strong Authentication. Unmanaged Device. Untrusted Network. Sensitive Data Downloaded.
6 min read · 17 Aug 2026
Coordinated Response Failures
Vendor Plan: Preserve Everything. Customer Plan: Service Restored in Twenty-Four Hours. Both Correct. Both Impossible.
5 min read · 15 Aug 2026
Cross-Org Response Timelines
Same Threat. Two IR Teams. Seven IOCs and Four IOCs. No Sharing. Ten Total Missed.
5 min read · 12 Aug 2026
Cross-Platform Visibility
Vendor Monitors AWS. DevOps Provider Monitors the Cluster. Both Assume. Neither Confirms.
5 min read · 10 Aug 2026
Cross-System Identity Propagation
Deprovisioned in Azure AD. Active in the Jira Instance Nobody Added to the Connector.
6 min read · 7 Aug 2026
Cross-Tenant Access Risks
When Your Vendor Serves Other Customers , and Their Risk Becomes Yours
8 min read · 5 Aug 2026
Cross-Tenant Attack Detection
Customer A Breached. Investigation: Did Not Spread. Customer B Notified Three Weeks Later.
5 min read · 2 Aug 2026
Data Exfil Detection Gaps
Twelve Transfers. Eleven Gigabytes. All Below the DLP Threshold. No Alerts.
6 min read · 31 Jul 2026
Delegated Admin Risks
Delegated Admin Granted at Onboarding. Configuration Ended. Access Remains.
7 min read · 28 Jul 2026
Detection Blind Spots
Platform Sees Everything Configured. Configuration Set at Deployment. New Services: Not Configured.
7 min read · 26 Jul 2026
Detection Engineering Gaps
Default Rules. Platform Inherited. No Customisation. Attacker Uses Industry-Specific Techniques.
6 min read · 23 Jul 2026
Detection vs Prevention Balance
Zero Breaches. Three Near-Misses. Prevention Working. Breach Record Not Telling the Story.
5 min read · 21 Jul 2026
Device Trust for Vendor Access
Perfect Authentication. Unmanaged Device. Customer Data on a Personal Laptop.
6 min read · 18 Jul 2026
Forensics Access Challenges
Forensic Access Requested. Legal Hold In Place. Investigation Blocked for Three Weeks.
6 min read · 16 Jul 2026
Identity Anomaly Detection Gaps
2am. Lagos. Seventeen Apps. Six Hundred Files. No Alert.
7 min read · 13 Jul 2026
Identity Attack Surface Expansion
One IdP Three Years Ago. Seven Authentication Systems Today. Who Is Mapping Them?
6 min read · 11 Jul 2026
Identity Compromise Blast Radius
The Compromise Will Happen. The Blast Radius Is What You Govern Now.
6 min read · 8 Jul 2026
Identity Federation Trust Risks
You Federated with Their IdP. Their Security Posture Is Now Part of Your Perimeter.
7 min read · 6 Jul 2026
Identity Governance Gaps
The IGA Covers Joiners, Movers, and Leavers. Vendor Identities Are in a Spreadsheet.
7 min read · 3 Jul 2026
Identity-Based Lateral Movement
One Developer Credential. Four Identity Hops. Production Database.
6 min read · 1 Jul 2026
Identity Logging Gaps
Authentication Succeeded. The Sixty-Eight Failed Attempts Before It Are Nowhere in the Log.
7 min read · 28 Jun 2026
Identity Proofing of Vendors
The Credential Belongs to Alex Chen. Who Is Alex Chen?
7 min read · 26 Jun 2026
Identity Trust Assumptions
Trust Was Established at Onboarding. It Has Been Assumed Ever Since.
6 min read · 23 Jun 2026
Incident Communication Breakdowns
Seven Emails. Three Weeks. No Technical Detail. Exposure Assessment Incomplete.
6 min read · 21 Jun 2026
Incident Escalation Across Vendors
Vendor Classifies P2. Customer Regulatory Clock Starts at Hour Zero. Customer Learns at Hour Thirty-Six.
6 min read · 18 Jun 2026
Incident Ownership Confusion
Legal Says Business Owns It. Business Says IR Owns It. IR Says Legal Owns It. Clock Running.
5 min read · 16 Jun 2026
Incident Playbook Gaps
Step Four: Isolate Per Appendix C. Weekend. Nobody Has Appendix C. Forty Minutes Lost.
6 min read · 14 Jun 2026
Incident Response SLAs
Forty-Seven Hours Fifty-Nine Minutes. SLA Met. Scope Unknown. Customer Cannot Respond.
5 min read · 12 Jun 2026
Insider Threats at Vendors
Legitimate Access. Personal Cloud Account. Seventeen Thousand Records. Three Months.
6 min read · 10 Jun 2026
Just-in-Time Access vs Standing Access
Standing Access Runs 720 Hours a Month. It Is Needed for Four.
7 min read · 9 Jun 2026
Least Privilege in Vendor Access
You Gave Them Admin Because It Was Easier. It Was Never Revoked.
8 min read · 8 Jun 2026
Log Ingestion From Vendors
The Logs Existed. They Were in the Vendor's Infrastructure. The Incident Was Day Forty-Two.
6 min read · 7 Jun 2026
MFA Enforcement Gaps
MFA Required for All Users. Except the Ones That Matter Most.
6 min read · 6 Jun 2026
Machine Identities vs Human Identities
Four Hundred Humans. Eighteen Hundred Machines. One Governance Program.
6 min read · 5 Jun 2026
Multi-Cloud Vendor Risk
When Your Vendor's Architecture Spans More Clouds Than Your Governance Does
9 min read · 4 Jun 2026
OAuth Scope Overreach
It Asked for Read Email. It Also Asked for Everything Else. You Clicked Accept.
7 min read · 3 Jun 2026
Orphaned Vendor Accounts
The Relationship Ended Fourteen Months Ago. The Accounts Are Still Active.
7 min read · 2 Jun 2026
Overprivileged Service Accounts
The Backup Job Needs One Schema. The Service Account Has Full DBA Rights.
8 min read · 1 Jun 2026
Privileged Access Management (PAM) Gaps
The PAM Is Deployed. Customer Environment Access Bypasses It Entirely.
7 min read · 31 May 2026
Role-Based Access vs Actual Usage
The Role Grants Six Permissions. The Job Uses One. Five Are Waiting.
5 min read · 30 May 2026
SIEM Coverage Limitations
SIEM Covers the Primary Cloud. The Database, IdP, and CI/CD Are Not Connected.
5 min read · 29 May 2026
SOC Automation Limitations
Forty Percent Automated. Two Playbooks Silently Broken. Those Categories: No Alerts for Three Months.
5 min read · 28 May 2026
Secrets & Key Management
The Credentials Nobody Is Watching , Until Something Goes Wrong
6 min read · 27 May 2026
Security Operations Silos
AppSec Found a Vulnerability. Endpoint Found a Misconfiguration. Cloud Found an Exposure. Nobody Connected Them.
5 min read · 26 May 2026
Vendor Access via Service Principals
The Non-Human Identity Your Vendor Left Running in Your Tenant
9 min read · 25 May 2026
Session Hijacking Risks
Undefeatable MFA. Stealable Session Token. The Attacker Chose the Token.
6 min read · 24 May 2026
Shadow Cloud Usage by Vendors
The Infrastructure You Never Approved Running in Your Name
9 min read · 23 May 2026
Shared Incident Response Responsibilities
Your IR Plan Works for Your Environment. The Breach Is in Theirs.
6 min read · 22 May 2026
The Shared Responsibility Model
Vendor vs Customer Reality , Who Actually Owns What in the Cloud
8 min read · 21 May 2026
Misconfigured Cloud Storage Exposure via Vendors
S3 Buckets, Blob Containers, and the Data Your Vendor Left Unlocked
9 min read · 20 May 2026
Threat Detection Blind Spots
Known Bad IPs: Blocked. Valid Credentials Used. SMB Lateral Movement: Detected. Admin Tools Used.
6 min read · 19 May 2026
Threat Hunting Across Vendors
Threat Hunt Active. CI/CD Pipeline Not in Scope. Attacker Pivoted There.
5 min read · 18 May 2026
Threat Intel Integration Gaps
IOCs Published. TI Platform Updated. SIEM: Twenty-Four-Hour Batch Lag. Malware Active.
6 min read · 17 May 2026
Token Persistence Risks
The Application Is Gone. The Token Is Active. The Access Remains.
7 min read · 16 May 2026
Vendor Admin Account Sprawl
Fourteen Admin Accounts. Five Should Exist. Nine Are a Liability.
7 min read · 15 May 2026
Vendor Alert Visibility Gaps
The Vendor's SOC Sees the Alerts. You See What They Decide to Tell You.
6 min read · 14 May 2026
Vendor Breach Detection Delays
Detected Tuesday. Customer Notified Friday. Three Days of Silent Exposure.
6 min read · 13 May 2026
Vendor Break-Glass Accounts
Designed for Emergencies. Used for Convenience. Same Credential.
6 min read · 12 May 2026
Vendor Compromise Indicators
Service Account Compromised Day Three. Detected Day Twenty-Two. Data Access: Unconfirmed.
6 min read · 11 May 2026
Vendor Containment Coordination
Isolate That Server. Three Thousand Other Customers Are On It. The Attacker Stays.
5 min read · 10 May 2026
Vendor Directory Integration Risks
Their Directory Syncs to Yours. Their Security Posture Is Now Part of Your Identity System.
6 min read · 9 May 2026
Vendor-Managed Encryption Keys
Who Controls the Keys Controls the Data
10 min read · 8 May 2026
Vendor Escalation Paths
Sunday 9pm. Breach Confirmed. Four Escalation Steps. Unmonitored Inbox.
6 min read · 7 May 2026
Vendor IAM Roles in Your Cloud
The Permissions You Granted and Probably Forgot About
9 min read · 6 May 2026
Vendor IR Plan Maturity
Two-Page IR Overview. Last Exercise: Unknown. Ransomware Playbook: Not Documented.
5 min read · 5 May 2026
Vendor IR Testing Frequency
Two Tabletops. Three Years. Same Scenario. Security Team Only. IR Is Exercised.
5 min read · 4 May 2026
Vendor Identity Audit Evidence
Governance Confirmed. Evidence Unavailable. Both Cannot Be True for Compliance.
7 min read · 3 May 2026
Vendor Identity Compromise Scenarios
The Attacker Is Authenticated. Every Access Event Looks Legitimate.
7 min read · 2 May 2026
Vendor Identity Lifecycle Management
One Hundred Vendor Accounts. Forty-Two Former Employees. Nobody Knew.
7 min read · 1 May 2026
Vendor Identity Monitoring
You See the Connection. The Vendor Sees Everything That Happened Before It.
6 min read · 30 Apr 2026
Vendor Identity Risk Scoring
One Hundred Vendor Employees. One of Them Is Your Highest Risk. Do You Know Which One?
7 min read · 29 Apr 2026
Vendor Monitoring Coverage
Vendor SOC Monitors Vendor. Customer SOC Monitors Customer. Attack Travels Between.
5 min read · 29 Apr 2026
Vendor Onboarding/Offboarding Delays
Access Too Slow When Needed. Too Slow to Remove When Not.
7 min read · 28 Apr 2026
Vendor Passwordless Adoption Risks
The Front Door Is Passwordless. The Side Doors Still Take Passwords.
6 min read · 28 Apr 2026
Vendor Response Validation
Remediation Report: Complete. Three Weeks Later: Same Attacker. Secondary Backdoor Missed.
5 min read · 27 Apr 2026
Vendor SOC Integration
Two SOCs. Two Investigations. Three Hours of Gap. Attacker Exploited the Seam.
5 min read · 27 Apr 2026
Vendor SSO Integration Risks
SSO Connected. Every Identity in the Directory Can Now Access the Vendor Platform.
7 min read · 26 Apr 2026
Vendor Shared Accounts
Five Engineers. One Account. Zero Accountability.
7 min read · 26 Apr 2026
Vendor Telemetry Limitations
Primary Cloud: Rich Logs. Database: Minimal. SaaS: UI Only. Contractor VPN: Connection Only.
5 min read · 25 Apr 2026
Vendor Threat Visibility
Half the Attack in the Vendor's SIEM. Half in the Customer's. Neither Half Made Sense Alone.
5 min read · 25 Apr 2026
Cloud Workload Isolation Failures
When the Boundary Between Workloads Is Thinner Than You Were Told
9 min read · 24 Apr 2026