Cybersecurity Insights
Technical writing on payment security, segmentation, ransomware recovery and the controls that decide real-world outcomes.
Payment-page scripts after PCI DSS 6.4.3 and 11.6.1: what assessors now expect
The two client-side requirements have been mandatory since 31 March 2025. Eighteen months on, buying a tool is the easy part. The hard part is proving authorization, integrity and tamper detection for scripts you do not fully control.
Read
Segmentation is a claim. Testing is the proof.
Network segmentation is the most powerful lever for reducing PCI DSS scope, and the one most often asserted without evidence. A practical guide to what requirements 11.4.5 and 11.4.6 demand, and how to test segmentation in cloud and hybrid estates.
Read
Ransomware recovery is a control. Test it like one.
Most organizations can show that backups run. Far fewer can show that they could rebuild identity, restore critical services in a known order and do it while an adversary may still be present. Recovery capability should be evidenced, not assumed.
ReadWhere this thinking is applied.
Talk to the people who wrote it.
Tell us what you are preparing for. A senior practitioner who has done this work will reply within one business day.