Zero trust without the slogans
Zero trust is a sequence of unglamorous work. Start with identity, then device posture, segmentation and logging, and plan for what the slogan leaves out.
Insights
Notes from the workbench.
Practical writing on security, software, integration and cloud platforms, for people who have to make these things work.
What a penetration test can and cannot tell you
A pen test is a time-boxed sample of your security. Here is how to scope one properly, read the report critically and get value from the retest.
The first hour of a security incident
The first hour is decided by preparation. Who has authority, how to preserve evidence, how to communicate and what can wait until later.
The Privacy Act 2020 for engineers
What New Zealand's Privacy Act means for system design, covering collection, retention, access, breach notification, overseas disclosure and IPP 3A.
Modernising legacy systems without a big-bang rewrite
Replace old systems piece by piece. Use characterisation tests to pin behaviour and the strangler fig pattern to move traffic gradually.
Software supply chain hygiene
Most of the code you ship was written by someone else. Pin dependencies, generate SBOMs, shorten CI credentials and verify what you deploy.
Treat integration as a product
Integrations fail at boundaries nobody owns. Give them contracts, idempotency, disciplined retries, business-level monitoring and a named owner.
Six questions before a cloud migration
Answer these six questions in writing before moving workloads, and you will spot the expensive surprises while they are still cheap to deal with.
Cloud costs without the theatre
Cloud cost control comes from ownership and unit economics. Tag what matters, right-size before committing and give every bill a named owner.
Backups you have never restored
A successful backup job proves little. Set RPO and RTO with the business, make copies immutable and run restore drills that measure real recovery.
Start a conversation
Tell us what you are trying to do.
A few plain sentences are enough. Send us the problem, the deadline if there is one, and what has already been tried. We will tell you honestly whether we are the right people to help.
Get in touch support@vnet.nz