Practical, KQL-heavy lessons on Microsoft Sentinel and Entra ID security, covering detection rule tuning, log cost reduction and exposure from anonymous sharing links. Each issue critiques a common default or assumption and shows a concrete fix.

In-depth articles on Microsoft endpoint and identity security architecture, covering Conditional Access, Windows LAPS, and Intune, with design trade-offs and documented limitations. Includes field incident write-ups that trace a real production problem to its root cause and fix.

Philip Walley writes about enterprise cybersecurity topics including SASE, Zero Trust, AI agents and authorization for leaders designing secure networks. The issues offer a clear point of view, such as treating AI agents like temporary contractors and enforcing limits architecturally rather than through prompts.

Risky Business newsletter covers cybersecurity breaches, vulnerabilities and threat actor activity with short news items and links to its podcast episodes. The sample shows concise, news-style reporting on incidents such as a Tor exit node hijack, a KVM escape vulnerability and an arrest of a hacking group.