How to scope a penetration test that produces fixes
If the scope is vague, the report will be too. Write the boundaries before anyone quotes a day rate.
Insights
Writing on the work
Technical notes on security testing, measurement, and search. Published when there is something useful to say.
Published
10
Vulnerability scan vs penetration test: stop buying the wrong one
One enumerates known weaknesses. The other tries to prove impact. Mixing the labels is how budgets disappear.
What breaks the week you set DMARC to reject
Reject is the point of DMARC. It is also when every forgotten sender becomes your problem.
Why Google Ads ROAS can look healthy while revenue falls
Platform ROAS is not a bank balance. Treat it as a directional signal, then reconcile to closed revenue.
Fix the landing page before you raise the ad budget
More spend on a weak page buys more expensive proof that the page is weak.
What generative engine optimisation actually changes on your site
GEO is not a plugin. It is clearer answers, cleaner structure, and pages machines can quote without guessing.
Technical SEO debt that quietly kills organic traffic
Most traffic loss is not a Google mood. It is index bloat, broken canonicals, and pages that never deserved a crawl.
Why B2B social calendars fail (and what to track instead)
A filled calendar is not a pipeline. Measure conversations and assisted revenue, not posting streaks.
Where ecommerce checkouts leak paid traffic
You paid for the click. The cart, the shipping estimator, and the payment step decide whether you keep it.
Security tooling nobody uses: how to avoid shelfware
A platform that does not fit the workflow becomes a renewal line and a false sense of coverage.