Field Notes
Cybersecurity, written for the businesses that actually need it.
Plain-language guides, breach commentary, and compliance breakdowns — built for small and mid-size businesses, by the engineers in our SOC. No fear-marketing. No vendor pitches. Just what works.
Featured
Your cyber insurance renewal questionnaire, line by line.
Underwriters are tightening every clause. Here's what each control actually means, what evidence to keep, and where to push back — written by engineers who've answered this questionnaire on both sides of the table.
Read the breakdownThe latest from our SOC.
Security Basics
MFA, plainly: what it is, why your insurance asks, and the three ways small businesses get it wrong.
Multi-factor authentication blocks 99% of automated account attacks. Most SMBs deploy it halfway. Here's the no-jargon version — and the three mistakes we see at almost every audit.
Security BasicsWhat is a SOC, and does your small business actually need one?
Security Operations Center. SOC. MDR. MSSP. The acronyms blur. Here's what these services actually do, what they cost, and the questions to ask before you pay anyone to watch your alerts.
How-ToWhat a 2026 phishing email actually looks like.
Broken English and weird URLs are gone. Here's what modern phishing actually looks like — and the five patterns your employees still need to recognize.
Compliance & Regulation
The HIPAA Security Risk Assessment most small practices get wrong.
OCR isn't auditing your antivirus license. They want a documented risk assessment that maps to 45 CFR § 164.308. Here's the 8-page version your auditor will accept.
RIA · SECWhat an SEC examiner actually looks for at a small RIA.
Reg S-P, the proposed cybersecurity rule, and the 2026 exam priorities — in plain English, with the controls that satisfy them.
Cyber InsuranceYour cyber insurance renewal questionnaire, line by line.
Underwriters are tightening every clause. Here's what each control actually means, what evidence to keep, and where to push back.
Need this turned into a real plan for your environment?
A 30-minute call. No deck, no pressure. If we're not a fit, you walk away with notes.