Every OSINT analyst has been there. You pulled the threads, mapped the connections, built the timeline. The data looks clean and the narrative holds. Then someone asks a question you didn't consider and the whole picture shifts. The failure was not in your tooling or your collection. It was in your reasoning. The missing discipline in information security is not technical. It...

The format hasn't fundamentally evolved in decades. Jeopardy, King of the Hill, Attack/Defense, those three buckets cover essentially everything competitive CTF has produced, and the innovation inside them is almost entirely in challenge content, not game mechanics. Harder reversing. Cleverer crypto. More obscure forensics. Same skeleton, just dressed differ...

Part 2 of a series on creating information security policies

Many breaches don’t start with sophisticated hackers; they start with ordinary users doing ordinary things in unsafe ways. Let’s look at 3 ways to work toward helping people in our organizations understand better how to safeguard everyone’s information.

Because there are as many ways to create ...

Most paths into cybersecurity run through the same checkpoints. Certifications. Lab environments. CTF competitions. These things have real value, they build vocabulary, they build technique, they get people hired. But there's a ceiling on what they can teach, and that ceiling shows up quite quickly when someone sits down to ponder an actual real world investigative scenario.<...