// FIELD NOTES

What the field keeps teaching

Case files from incidents, tests, migrations and builds, and plain-English notes from the people who do the work. Written to be useful, not to frighten you.

Browse the board

// THE INDEX

Every file, one screen

Point at a line to read it. Type to narrow it down. 11 files, nothing buried.

Declassified files are composites of real engagements, with identifying details changed, and each one says so at the top.

DECLASSIFIED 2026.07.22

The stolen laptop that stopped being a problem in nineteen minutes

A partner's laptop was taken from a car in a Melbourne car park on a Friday afternoon. The call came in at 4:41pm. By 5:00pm her sessions had been revoked, her password reset, a remote wipe issued and disk encryption confirmed, and the firm had the evidence it needed for its privilege obligations.

Sector: Legal
Services: Managed Security, Incident Response
Published: 22 July 2026
Read: 5 min

Open the file

FIELD NOTE 2026.07.16

What Australian businesses need for cyber insurance in 2026

Cyber insurers now expect real security controls before they quote or pay out. Here are the controls Australian businesses are commonly asked for, and how to be ready before you apply.

Published: 16 July 2026
Read: 4 min

Read the note

DECLASSIFIED 2026.07.08

The Tuesday night an accounting firm slept through

A workstation started talking to a known malicious host at 3:08am. By 7:58am the write-up was in the partner's inbox and the day ran like any other.

Sector: Accounting
Services: Managed Security, Incident Response
Published: 8 July 2026
Read: 3 min

Open the file

DECLASSIFIED 2026.07.01

The agent that reads the intake inbox, and the two things it is not allowed to do

An agent that triages a shared intake inbox and saves about nine hours a week. The interesting part is not what it does. It is the two capabilities we deliberately did not give it, and the week spent on data boundaries before anything was built.

Sector: Professional services
Services: AI and Workflow Automation, Governance
Published: 1 July 2026
Read: 4 min

Open the file

FIELD NOTE 2026.06.18

Notifiable data breaches: when an Australian business must report

When a data breach must be reported under Australia's Notifiable Data Breaches scheme, who the rules cover, the 30-day assessment window, and the steps to take if it happens to you.

Published: 18 June 2026
Read: 4 min

Read the note

DECLASSIFIED 2026.06.17

Two findings nobody would have fixed, and what they did together

A scan had already found both issues and rated them low and medium. Manual testing showed that one ordinary signed-in account could read other patients' clinical records, and that the low one made real accounts easier to target. This is the part of a penetration test that automation cannot do.

Sector: Allied health
Services: Security Assessments and Penetration Testing, Penetration Testing
Published: 17 June 2026
Read: 4 min

Open the file

DECLASSIFIED 2026.05.20

The server in the storeroom, and the spreadsheet that nearly broke the cutover

A migration quoted twice and started never. The assessment found eleven undocumented dependencies, including a finance spreadsheet pointing at the server by name that would have failed at month end, three weeks after everyone declared the project a success.

Sector: Manufacturing
Services: IT Projects and Microsoft 365, Cloud Migration
Published: 20 May 2026
Read: 4 min

Open the file

FIELD NOTE 2026.05.14

Penetration test vs vulnerability scan: which do you need?

The difference between a penetration test and a vulnerability scan, when each is worth the money, and how to tell which one your Australian business actually needs right now.

Published: 14 May 2026
Read: 4 min

Read the note

DECLASSIFIED 2026.04.29

The questionnaire that arrived on a Thursday

A funding body sent a 68-question security questionnaire with a two-week deadline. The honest answer to most of it was we do not know. Six weeks later the same questions took forty minutes, because the evidence had somewhere to live.

Sector: Not-for-profit
Services: GRC, Essential Eight
Published: 29 April 2026
Read: 4 min

Open the file

FIELD NOTE 2026.04.16

The Essential Eight explained for Australian small business

A plain-English guide to the ASD Essential Eight for Australian small and mid-sized businesses: what the eight controls are, how the maturity levels work, and where to start.

Published: 16 April 2026
Read: 7 min

Read the note

DECLASSIFIED 2026.03.11

The spreadsheet that ran the roster, and the feature we talked them out of

A rostering spreadsheet only one person could edit, holding clinician availability and participant details. The build took nine weeks. The most useful thing we did was persuade them to leave a third of their wish list out of it.

Sector: Allied health
Services: Custom Software and Integrations, Security Review
Published: 11 March 2026
Read: 4 min

Open the file