Field notes
We publish what we learn.
Research and disclosure are part of the craft. Short, technical, no marketing fluff — written by the team doing the work.
2026 · GOVERNANCE
POPIA and the quiet breach
Most incident response plans are written around a moment that feels obvious in hindsight: the point where you know you’ve had a breach. POPIA…
4 min read · Read →
2026 · IDENTITY
Past the MFA wall
“We have MFA” used to end the conversation. It doesn’t anymore. Most identity compromises we see today don’t defeat multi-factor authentication at all —…
4 min read · Read →
2026 · ATTACK PATHS
What 90 minutes looks like
90 minutes is the number we keep coming back to. Not because it’s an average — every engagement is different — but because it’s…
4 min read · Read →