Educational, operationally useful, and intelligence-focused. Published when there's something worth saying — not on a content calendar.
Five recurring decisions that decide whether a ransomware event becomes a recoverable disruption or a board-level crisis. Drawn from recent matters; identifying details removed.
Why static indicators keep failing mid-market defenders, and what behavior-led detection actually buys you in practice.
A pragmatic ruleset baseline for small environments: what we keep on by default, what we tune down, and what we add.
A short discipline-first guide to attribution work that survives counsel review, opposing experts, and a court of law.
A short primer for counsel: how the term is used in carrier records vs. in expert testimony — and where it's commonly misread.
Hermes' design choices around audit, replay, and human override — and why those constraints are the point, not a limitation.
A short framing that gets executives a defensible answer to "are we okay?" without burying them in maturity grids.