Field Notes From Real Security Work
Practical write-ups on the detection controls, rollouts, and audit challenges we've worked through directly — not theory, not marketing copy.
Latest
PHP2Shell: A Four-Stage Response to Two Critical PHP Vulnerabilities
Public reporting on CVE-2026-109618 and CVE-2026-109619, plus PHP's separate October 23, 2026 advisory. This is an incident-based analysis and a recommended response framework, not a SecureBit client engagement.
- Vulnerability Management
- Cyber Risk
- Incident Readiness
More field notes
EDR Metrics That Actually Matter: Beyond Alert Counts and Coverage Percentages
Most EDR dashboards report numbers that feel like progress but don't answer the one question leadership needs answered: are we faster than the attacker?
- EDR
- Metrics
- Detection Engineering
Detecting Ransomware Over SMB Shares: An EDR-Based Approach
Ransomware rarely announces itself on the endpoint that started it. It shows up as a wave of file changes on a network share. Here's how to catch it there.
- Ransomware
- EDR
- File System Containment
On-Write Script File Visibility: Closing a Blind Spot in Endpoint Monitoring
Most endpoint policies watch what a script does when it runs. On-write visibility watches the moment it's written to disk — before it ever executes.
- EDR
- Script Visibility
- Detection Engineering
Auditing Endpoint Coverage at Scale: Lessons from a Multi-Subsidiary Sensor Upgrade
Upgrading EDR sensors across thousands of endpoints and multiple subsidiaries surfaces coverage gaps a single-environment rollout never would.
- EDR
- Sensor Management
- Audit Evidence
Working through something similar?
We can help you assess, design, and roll out the same kind of control in your own environment.
We reply within one business day. We work with organizations in Canada and North America.