Observations · Security Artifacts

Observations

One thing that worked, one that did not, and one number worth watching. Published weekly, kept short on purpose.

No.01
The detection that was switched off in March
Issue one. A control that existed and had been disabled nine weeks earlier, a signup flow that failed silently for anyone behind a VPN, and the retention number that decides whether any of the rest matters.
1 September 2026

Why that name

Named for the doctrine distinction between a lesson observed and a lesson learned: a lesson is not learned until behaviour has changed and somebody has checked. Pretending otherwise is how the same finding turns up in three consecutive post-incident reports.

The shape of an issue

What worked. Something that went right, and why it did.
What did not. Written plainly, including when it is ours.
The number. One metric worth watching this week, and what it says.

Three sections, deliberately short. A format that survives a busy week is worth more than one that produces an excellent issue every other month.

Follow just this

Its own feed, separate from everything else on the site, so you can take the column without the rest.

RSS

Disagree with one

Every issue has a discussion under it. A reader whose estate behaved differently is the most useful thing that can happen to a column like this.

The detection that was switched off in March