Blog · Oct 2026
Why alert fatigue is a problem of joined-up evidence
More alerts are not the answer. Fewer cases, each already explained, are.
Field notes on the gaps between security tools
What we are learning from security leaders, and how hybrid threats move between systems, sites and teams.
Field note · Nov 2026 · 6 min read
What security leaders told us about the gaps between their tools
Where they see risk between systems, what they say their SIEM covers and does not, how contractors and AI agents change the picture, and the question they ask most.
“So what would I do differently?”
The question we heard most in 2026
Blog · Sep 2026
Entity-centric vs alert-centric security
Why organising evidence around the person or asset changes what a team can see.
Webinar · Oct 2026
Impossible travel: catching credential misuse across badge and login
Two valid events that cannot belong to one legitimate journey.
Guide · Coming soon
What is Holistic Security Intelligence?
The definitive explainer, and the questions to ask of any platform that claims it.
Guide · Coming soon
The Cyber Security and Resilience Bill: what operators will need to evidence
For CNI operators, data centres and managed service providers.
Guide · Coming soon
Martyn's Law and the control room
What event-day evidence looks like for UK venues.
Get the monthly field notes
One email a month. No sales sequence.