Newsletter
The Defender Brief
The week's threats and what to do about them, in one email a week.
The Defender Brief
Get the brief every week.
One email a week. Unsubscribe anytime.
What you get
One email a week that connects the week's reports into a single argument and ends with where to focus on Monday. Every issue links the reporting behind it. Issues go out by email only.
Example brief · October 16, 2026
Attackers Are Editing the Evidence
I'd be uneasy closing an alert because the software looks normal again after reading this week's AOMEI and Ivanti investigations. In both cases, restoring settings was part of the attacker's cleanup. BeyondTrust adds deliberate log deletion to the comparison. These reports make me question how often we ask a current check to explain an earlier event. The decision I'd change is when we collect evidence: preserve the records behind the alert while they're available, with copies outside the system under investigation.
In this issue
- Normal again, within minutes
- Who holds the record?
- Where I'd focus
Nulltap reporting