Partner-written thought leadership from across the four practices. Filter by the team that wrote it — or read the latest below. Published when we have something genuinely useful to say, not on a content calendar.
The 90-day migration from a legacy SIEM to Microsoft Sentinel. What we kept, what we replaced, how the analyst rota changed, and the mean-time-to-acknowledge numbers before and after the cut-over.
Read the full write-up →Why retrofitting governance after deployment guarantees an oversharing incident. The clinical-policy agent pattern, end to end.
Staged enablement, label inheritance, and the three controls we set before the first licence is assigned. A field playbook.
Evergreen bundles integrated Sentry XDR governance hooks into the Modern Workplace run. Here is what that means in the SOW, and why we hold a 99.96% availability SLA against it.
The unglamorous mechanics behind the number — shift handover, escalation ladders, and the runbooks that keep a 2am alert from becoming a 9am incident.
A structured suppression and enrichment programme that gave analysts their attention back. The before/after on alert volume and triage time.
How the Evergreen extensibility roadmap turns into a shipped agent: framing, build, land. Includes the refusal-rate measurement we use to decide ship/iterate/kill.
The two-week cadence we run from problem framing to a governed, measurable agent in production — and the guardrails that keep it inside policy.
Time-and-materials assurance is structurally compromised. Signed by the partner named on the SOW — delivered as a quarterly board pack and benchmark, not a slide deck.
Two programmes we have recommended killing in the last three years. Why the board agreed. What we wrote in the close-out paper.
Insights is partner-written, peer-reviewed, and published only when there is something genuinely useful to say. No ghostwriting, no SEO bait, no AI-summarised press releases.
Briefing notes from the four practice partners, delivered by email. No funnel, no nurture sequence.