Security

Security

Building a CoT Bridge: How to Get NVR, AIS and Drone Feeds onto a TAK Map Without Flooding It

October 1, 2026

Every TAK deployment we scope eventually arrives at the same question. The server is up, the field teams have ATAK on their phones, the map works — and then someone asks why the gate cameras, the…

Security

Inside simpliSSO: What a 12-Module Identity Rollout Actually Delivers, from Azure AD Federation to the Last Legacy ERP

October 1, 2026

We have written twice about why a company with a couple of dozen internal systems needs a single identity layer: once on the identity debt that builds up quietly in engineering organisations, and…

City Security

When the Canals Are Full: A Digital Twin for Urban Drainage, and What Bangkok’s September 2026 Flood Shows About Why It Matters

September 27, 2026

On 26 September 2026, after almost 48 hours of rain and close to 300 mm in parts of the city, Bangkok declared all 50 of its districts flood-disaster zones. The city’s pumping stations were running…

Security

Japan’s Active Cyber Defense Law Goes Live October 1: What “Report Promptly, Detail in 30 Days” Demands From Your SOC

September 24, 2026

Japan passed its Active Cyber Defense legislation in May 2025. The formal name is the Act on the Prevention of Damage Caused by Unauthorized Acts Against Critical Electronic Computers, and in…

AI Security

Shadow MCP: The AI-Agent Blind Spot Your SOC Isn’t Watching Yet

September 23, 2026

In October 2025 we wrote an enthusiastic post about how agentic AI and MCP servers work together. The architecture still holds. What changed in the eleven months since is the security picture around…

Security

Sovereign Hub-and-Spoke: Deploying OpenTAKServer for Multi-Site Border Security

September 20, 2026

TAK — the Team Awareness Kit ecosystem — has quietly become the default common-operational-picture layer for a growing list of non-US public-safety and border-security agencies, not just the US…

Security

Agentic AI SOC in 2026: The Verified Numbers Behind the Hype, and What simpliSOC Actually Ships

September 13, 2026

Every vendor with a SIEM or an EDR agent has an "agentic AI SOC" slide this year. Gartner gave the category a name in October 2025 — AI SOC Agents — and by June 2026 had already placed it at the Peak…

Industry Microcontroller Security

Teaching a Local LLM to Read Your Factory Floor: Explaining Security Alerts and Machine Logs with simpliSOC

September 3, 2026

Two people at a Thai manufacturing plant get pinged by the same underlying event, and neither of them understands it the way they need to.

AI Security

Using Small Language Models to Detect Cyber Attacks from Wazuh Logs and Firewall Syslog

August 26, 2026

Security operations centers drown in alerts. A mid-sized enterprise running Wazuh across a few hundred endpoints, plus a FortiGate or similar firewall forwarding syslog, can easily generate tens of…

Security

Passkey Enrollment Is Your New Attack Surface: What Pass-the-Passkey Means for Your IdP

August 22, 2026

The pitch for passkeys was simple, and it was true: there is nothing to phish. No string the user can be tricked into typing into a lookalike domain. For organizations that had spent a decade losing…

Security

Your Attacker Might Already Be an AI Agent: What the OpenAI–Hugging Face Incident Means for Your SOC

August 17, 2026

In late July 2026, OpenAI disclosed something security teams had been theorizing about for years and hoping wouldn’t arrive so soon: two of its own models, running inside what was supposed to be a…

Security

Your SOC Watches Your Employees. It Doesn’t Watch Your Vendors.

July 23, 2026

Third-party involvement in breaches doubled from 15% to 30% in a single year — the largest single-year shift ever recorded by the Verizon 2025 Data Breach Investigations Report. A supply chain…

Security

Securing the Agentic SOC: Prompt Injection, Log Poisoning, and the New Insider Threat

July 15, 2026

Every field in a security log that an attacker can influence is a field an attacker can write to. A hostname. A username. A DNS query. An HTTP User-Agent string. A process command line. None of that…

Security

3:47 AM: Inside a Real Incident Caught by an Open-Source SOC Stack

July 2, 2026

Most SOC content explains architecture. This one walks through an actual incident, alert by alert, on a production stack running for a mid-sized enterprise client — Wazuh for detection, DFIR-IRIS for…

Industry Security

Why Your Factory Floor Is the Softest Target in Your Network

June 27, 2026

Most security teams I talk to have reasonable IT hygiene: EDR on endpoints, a SIEM ingesting Windows event logs, maybe a WAF in front of the web apps. Then I ask them what’s running on the factory…

Security

Your Staff Have 24 Passwords. Your Business Has 24 Attack Surfaces.

June 11, 2026

Most companies don’t discover their identity problem until after the breach. A departing employee’s account stays active in three systems because nobody updated the offboarding checklist. A…

Security

The Security Risk Sitting Quietly in Your Engineering Org

June 8, 2026

Most engineering organisations share the same unspoken vulnerability: identity is everyone’s problem and no one’s responsibility. Here is how CTOs and engineering managers are fixing it — and what…

Security

SOAR and Alert Fatigue: Why Your SOC Is Drowning in Alerts (and How Automation Actually Helps)

June 7, 2026

If your SOC analysts are processing hundreds of alerts per day and still feel like they’re falling behind, you’re not alone. Alert fatigue — the state where analysts become desensitized to security…

Security

Wazuh vs Commercial SIEM: An Honest Comparison for Mid-Market Security Teams

May 31, 2026

If your security team is evaluating SIEM options, you will hit the same fork in the road everyone hits: pay six figures for Splunk or Sentinel, or run Wazuh for the cost of the infrastructure.

Security

What is a Security Operations Center (SOC)? A Guide for ASEAN IT Managers

May 31, 2026

Every week, another headline: a hospital hit by ransomware, a manufacturer’s production data exfiltrated, a government agency’s email system compromised. The attacks are not slowing down. But most…