Cybersecurity
Practical cybersecurity for teams that have to defend real environments, not slideware. Our analysts and advisors write about what actually moves risk — 24×7 detection and response, zero-trust architecture, identity and privileged access, exposure management, and the compliance frameworks your customers and auditors expect. Expect specifics you can act on, not vendor talking points.
What cybersecurity covers
Detection & response
24×7 SOC monitoring, managed detection and response (MDR/XDR), threat hunting, and incident response that contains threats instead of just alerting on them.
Zero trust & identity
Identity-first access, privileged access management, and segmentation that assume breach — plus the SIEM and analytics that make it visible.
Compliance & exposure
SOC 2, ISO 27001, HIPAA, and PCI DSS programs, penetration testing, and continuous vulnerability and attack-surface management.
Latest cybersecurity articles
InfrastructureCall Recording and Consent: What California Businesses Need to Get Right
California requires all-party consent to record a confidential communication. What that means for a business phone system, how the rules interact across state lines, and the controls that actually implement them.
CybersecurityCalifornia Privacy Law: What a Business Actually Has to Do
Thresholds, consumer rights, the sale-and-sharing distinction that catches advertising pixels, and the operational work of honouring a deletion request across every system that holds the data.
CybersecurityCMMC Level 2: What Defence Suppliers Actually Have to Do
If your contracts involve controlled unclassified information, assessed CMMC is becoming a condition of award rather than a promise to comply. The practical shape of Level 2 readiness.
CybersecurityStarting Data Loss Prevention Without Blocking the Business
DLP projects fail in one of two ways: nothing is ever enforced, or enforcement blocks legitimate work and gets switched off. The deployment order that avoids both.
Managed ITIT for a Dental Practice: The Things That Actually Cause Problems
Practice management software, imaging, HIPAA and a schedule with no room for downtime. What matters in a dental practice's IT, from people who have had to fix it mid-morning.
InfrastructureE911 on a Cloud Phone System: The Obligations Most Businesses Miss
Two federal laws set specific requirements for multi-line phone systems: direct 911 dialling without a prefix, notification to a central point, and dispatchable location. What that means in practice.
- Cybersecurity
Email Security Beyond the Spam Filter
The attacks that cost money now arrive from real accounts with no attachment and no link. Authentication, mailbox rule monitoring and a verbal verification step do more than better filtering.
CybersecurityA Conditional Access Baseline That Won't Lock You Out
Microsoft Entra Conditional Access is the most useful security control most organisations own and never configure properly. A starting policy set, in the order to deploy it, with the break-glass account that keeps you in.
CybersecurityThe FTC Safeguards Rule Applies to More Businesses Than Think It Does
Auto dealers, tax preparers, mortgage brokers, debt collectors and many others are covered financial institutions under the Safeguards Rule. The nine required elements, in plain terms.
CybersecurityGLBA for Smaller Financial Firms: The IT Obligations
Advisers, brokers and lenders handle customer financial information under the Gramm-Leach-Bliley Act. The privacy notice is the part everyone does; the safeguards are the part regulators examine.
InfrastructureFax Is Still Here: Doing It Properly Under HIPAA
Healthcare still runs on fax, and the machine in the corridor is one of the most common sources of avoidable PHI disclosure. What cloud fax changes, what it doesn't, and the controls that matter.
CybersecurityProtecting Company Data on Personal Phones Without Managing the Phone
Full device management on an employee's own phone is intrusive, unpopular and often unnecessary. App protection policies secure the data instead of the device — here's where the line falls.
Managed ITIT Security for Law Firms: Confidentiality Is a Professional Obligation
Client confidentiality, conflict walls, retention that spans decades, and clients who now audit their outside counsel. What a firm's IT has to get right, and where firms usually fall short.
InfrastructureThe Phone System Is a HIPAA System: Configuring It That Way
Voicemails, call recordings, transcripts, appointment reminders and the answering service all carry protected health information. Where practices get the configuration wrong.
- Cybersecurity
Offboarding That Actually Revokes Access
Disabling the account is the part everyone does. The access that survives is in the places nobody owns: shared credentials, personal devices, API tokens and the applications IT never knew about.
CybersecurityPCI DSS: Working Out Which Self-Assessment Questionnaire Applies
The SAQ you qualify for determines whether you answer two dozen questions or three hundred. It is decided by how card data flows through your systems — which most businesses have never actually mapped.
AITranscribing Calls Creates a Searchable Copy of Everything Customers Told You
Audio recordings are hard to mine. Transcripts are text, indexed and searchable — which changes the risk profile entirely. What redaction can and cannot do about it.
- Cybersecurity
The Printer Is a Networked Computer With a Hard Drive
Multifunction devices scan to email, store document images, hold network credentials and run an unpatched web server. They are routinely the least-managed device on a business network.
InfrastructureDesigning a Shop Floor Network That Doesn't Stop Production
Manufacturing networks carry machines that cannot be patched, cannot be rebooted during a shift, and were never designed to be on a network at all. How to segment without breaking production.
Managed ITDon't Publish an SLA Number You Can't Evidence
We removed a financially-backed availability figure and a compliance claim from our own pricing page because no document existed behind either. What to publish instead, and why it converts better.
CybersecuritySOC 2 Type 1 or Type 2: Which One You Need, and When
Type 1 is a photograph, Type 2 is a film. The difference decides your timeline, your cost and whether the report will actually satisfy the customer asking for it.
Managed ITThe CAPTCHA That Isn't There: Why render() Silently Does Nothing
Our signup page showed a blank gap where the bot challenge should be. No error, no token, every signup rejected. The cause was a race you never see in development, and the fix is a documented handshake most integrations skip.
CybersecurityEntra ID Single Sign-On for Multi-Tenant Apps: The Checks That Matter
Adding Microsoft Entra ID sign-in to a multi-tenant app: issuer and tenant checks, tid + oid identity, admin consent, certificate credentials, and a tested token verifier.
CybersecurityYour API Keys Are in Your Logs: HTTP Client Errors Leak Credentials
A failed API call logs more than you think: axios, got and friends attach your request to the error, so console, pino and winston print your Authorization header. How to check, how to fix it, and what to rotate.
Whether you’re planning a new initiative, hardening what you already run, or troubleshooting something that’s breaking, intSignal’s engineers own the tooling and the analysis so the outcome is measurable rather than best-effort. These articles reflect how we actually work with clients on cybersecurity — no vendor fluff, just what moves the needle. Explore the related services above, or talk to our team to scope a project or request an assessment.