Blog
Security writing for businesses without a security team
Practical guides to the parts of security you can actually change this week: email authentication, DNS records, TLS and browser headers, and how to judge an assessment report. Written for the person who also does the invoicing.
Most security content is written either for engineers who already know the answer or for buyers who need to be frightened into one. This section is for the third reader: the owner or operations lead of a small business who has to decide what to fix, in what order, with no budget for a security team.
Every guide follows the same discipline. It explains the mechanism, shows the check you can run yourself, states what a good result looks like, and says plainly where the advice stops working. No invented statistics, no fear marketing, no "10 signs you are being hacked" listicles.
If you want the RFC-level version of a topic instead, the knowledge base holds the reference articles. The two sections link to each other on purpose, and neither repeats the other's job.
Blog or knowledge base?
Blog — a sequence to follow, with commands, checklists and a decision at the end.
Knowledge base — the reference: how a mechanism works, what it does not protect, and where the specification says so.
Both are written from the same method, and both link to the published methodology.
Start here
Three guides that cover the most ground.
Email authentication, a whole-business baseline, and the assessment method these pages keep referring to.
SPF, DKIM and DMARC, explained without the acronym soup
What the three email records actually do, how they work together, and a ten-minute check you can run on your own domain without changing anything.
SMB security basicsCybersecurity for small businesses: the 2026 field guide
The threats that actually reach a small business, the five controls that carry the most weight, a 30-day starting plan, and how to tell whether any of it is working.
Assessment and scoringWhat is a security posture assessment?
A working definition, the five categories an external assessment can actually measure, and eight questions to ask before you buy one from anybody.
Clusters
Browse by area.
Each cluster is a hub: the guides in that area, the controls an external assessment can measure, and the technical reference behind them.
Email security, from the records up
Email is where most small businesses are impersonated first, because forging a sender is cheap and the invoice that follows looks exactly like a real one. These guides are the fixes, in the order that does not break your mail.
DNS securityDNS and domain security
DNS is the part of your infrastructure everyone depends on and almost nobody reads. It is also completely observable from outside, which makes it the cheapest place to find real problems.
Website and TLSWebsite, TLS and browser security
A padlock means the connection is encrypted to somebody. It does not mean the site is trustworthy, patched or safe. These guides separate the reassurance from the things that are actually verifiable from outside.
SMB security basicsCybersecurity basics for small businesses
You do not need a security department to close the gaps that most small businesses actually have. You need a short list, someone with the authority to change a record, and a way to check that it stayed changed.
Assessment and scoringAssessment, scoring and reports
A score is only useful if you can explain where it came from. These guides cover the method behind the number, what the number cannot tell you, and what to do in the week after you receive one.
All posts
Everything published so far.
Newest first. Each cluster hub collects its own guides, the controls they map to, and the reference article behind them.
SPF, DKIM and DMARC, explained without the acronym soup
What the three email records actually do, how they work together, and a ten-minute check you can run on your own domain without changing anything.
Email securityHow to roll out DMARC without breaking your email
A staged rollout that starts in monitoring mode, uses aggregate reports to find every sender you forgot about, and only then moves to enforcement.
Email securityWhy your business email keeps landing in spam
Authentication failures, mismatched sending domains, new-domain reputation and list breakage all look the same from the inbox. Here is how to tell them apart.
DNS securityWhat DNS security means for a small business
Your DNS records decide where mail goes, who may issue certificates for your domain, and whether a forged answer is detectable. Here is what to check, and how.
Website and TLS15 external website checks any business can run today
Fifteen things you can verify about your own website from outside, with the command or browser panel that shows each one and what a good result looks like.
SMB security basicsCybersecurity for small businesses: the 2026 field guide
The threats that actually reach a small business, the five controls that carry the most weight, a 30-day starting plan, and how to tell whether any of it is working.
Assessment and scoringWhat is a security posture assessment?
A working definition, the five categories an external assessment can actually measure, and eight questions to ask before you buy one from anybody.
Assessment and scoringExternal security assessment vs penetration testing
Breadth against depth, configuration against exploitation. What each engagement actually tests, when you need which, and how the two fit together in a year.
Assessment and scoringHow to check your company's external security posture for free
A twenty-five minute routine you can run yourself, what to write down, and the honest limits of a manual pass compared with a scored assessment.
Assessment and scoringHow to read your SMB Scanner Lite report
A guided tour of the report: metadata and consent record, the score and its arithmetic, evidence strings, inconclusive results, and the order to fix things in.
Editorial standard
What these guides will not do.
- No invented evidenceNo fabricated breach statistics, customer stories or benchmark numbers. Where a figure comes from a published report, it is named.
- No scanning by implicationNothing here encourages testing a domain you do not own. The instructions assume you are working on your own infrastructure.
- No product-first answersThe mechanism is explained before the tool is mentioned, and the limit of the tool is stated in the same paragraph.
- Corrections welcomeIf something is wrong or has aged badly, the contact form reaches the maintainer directly.
How often this is reviewed
Guides are reviewed when a specification, provider default or browser behaviour changes, and on a rolling annual basis otherwise. Each post shows its publication and last-updated date.
Posts that describe a provider's interface or a policy change carry a shorter review window, because those are the parts that go stale first.
Want the method applied to your own domain?
A private assessment runs the full 22-control catalog under a written scope, and returns the observation behind every conclusive finding.