Home › Insights
Notes from the work
Short pieces on what we actually find: cloud bills, networks and the compliance dates that are closer than they read. No vendor announcements.
WRITING
10 pieces
Each one is something we would say on a first call anyway.
Cisco IOS XE: the vulnerabilities attackers are using, and five things to check on your switches
The full CVE list for IOS XE runs to hundreds. The list of flaws attackers have actually used is 28 long, and five settings close most of them.
Read this →
An SBOM for CERT-In: the 21 minimum elements, explained, and how to check yours
Most build tools will write an SBOM in a minute. Most of those SBOMs fill about half of what CERT-In asks for, and the missing half is the part that needs people, not tools.
Read this →
Windows Server 2012 gets its last security fix on 13 October. What to do this fortnight
The paid extended updates run out, and there is no fourth year. The servers keep working, which is exactly why they get forgotten.
Read this →
You went live on Friday. Who owns it on Tuesday?
The implementation had a plan, a budget, an owner and an end date. The month after it goes live usually has none of those.
Read this →
Four questions before you fund an AI pilot
Most of the ideas we are asked about fail on the third or the fourth. Asking all four takes an afternoon. Finding out after the build takes a quarter.
Read this →
Right-size before you migrate, not after
An on-premise server was bought for its worst hour in three years. Copy it one-for-one into an instance and you have bought that worst hour every hour, on a meter.
Read this →
Your SLA probably promises a reply, not a fix
Response time is when somebody acknowledges you. Resolution time is when you can work again. Most support contracts guarantee the first and are silent on the second.
Read this →
Cloud savings have an order, and getting it wrong costs three years
Waste first, commitments second, architecture third. Buy the discount before you clean up and you have locked the waste in for the length of the term.
Read this →
India opened 6 GHz in January. What it changes for your next Wi-Fi refresh
500 MHz of licence-exempt spectrum, indoors, low power. If you are buying access points this year and the proposal does not mention it, ask why.
Read this →
DPDP lands on 13 May 2027. Three things that usually are not started
Eighteen months sounds comfortable until you try to answer the first question: where is personal data actually held?
Read this →
Firewall config check
Is your firewall the way attackers get in? Drop in its backup; every
password and key is stripped first, and the file never leaves your browser.
Check your firewall →
DPDP readiness check
What does DPDP need from you, by when? A to-do list dated to
13 May 2027, with the section of the Act behind each item.
Start the check →
Email security check
Can someone send email as you? Reads your domain’s SPF, DKIM
and DMARC and says what is missing, in plain English.
Check your domain →
Rather have it done than read about it?
A two-week review works through any of this against your actual estate, costs every change and ranks it by effort and risk.