Practitioner-grade writing on IAM, Zero Trust, and enterprise cybersecurity — grounded in 24+ years of hands-on work protecting the identity infrastructure of the world's largest organisations.
Read the missionWhy this blog exists
Almost every major breach in recent memory traces back to the same root cause: a compromised identity. A stolen credential. A misconfigured access policy. An over-privileged account that should have been revoked months ago. Identity is where attacks begin — and it is where defences must be strongest.
Yet most of the genuinely useful knowledge in this space stays locked inside enterprise security teams, vendor partner portals, and consulting engagements that cost hundreds of thousands of dollars. The practitioner who has actually deployed CyberArk across 200 applications, or wrestled with Entra ID hybrid join in a complex multi-forest environment, rarely has time to write about it.
Every article here is written from direct, hands-on experience. No vendor whitepapers regurgitated. No surface-level summaries. Just the patterns that work in production, the pitfalls that hurt, and the emerging capabilities that are reshaping enterprise security.
Technical depth
Identity & Access
IAM & Identity Governance
Privileged Access
PAM & Privileged Security
Cloud & Architecture
Cloud Security & Architecture
Security & Monitoring
Cyber Defence & SIEM
Automation & AI
AI-Driven Security Automation
Compliance & Governance
Frameworks & Compliance
What you will find here
IAM deep dives
End-to-end IAM architecture — SailPoint, Okta, Entra ID, CyberArk, RBAC models, IGA workflows, and access certification design. Production patterns, not theory.
Zero Trust
Moving beyond the buzzword into concrete implementation — Conditional Access policies, device compliance, least-privilege access, and network micro-segmentation.
Azure & Cloud Identity
Hybrid identity, Azure Virtual Desktop security, Microsoft Purview DLP, Defender for Identity — the configurations the official docs do not fully explain.
AI & Automation
n8n, Logic Apps, and AI agents applied to identity lifecycle automation, anomaly detection, and incident response. The emerging edge of enterprise IAM operations.
Compliance
HIPAA, NIST 800-207, SOC 2, ISO 27001 — how identity controls map to audit requirements, and how to build IAM programmes that satisfy regulators without breaking operations.
Career & Craft
Which certifications are worth pursuing, how enterprise clients evaluate IAM talent, and lessons learned across 24 years of working at the senior end of the identity security market.
Stay on the frontline
One email a week. A deeply researched post, a hard-won field note, or a practical configuration guide from an active IAM practitioner. No spam. No upsells. Unsubscribe instantly, any time.