Field notes &
playbooks.
Practitioner writing on cybersecurity, compliance, and the operational reality of running security programs. One email a month — subscribe.
The IAM rollout order for a 50-person SaaS.
Access control is the first real wall a growing SaaS hits. Here's the order to roll it out, what a SOC 2 review actually asks for, and where a spreadsheet is still genuinely fine.
A vCISO's first 90 days.
Ninety days with a vCISO does not fix security, it buys you a clear-eyed risk map, a plan you can afford, and a few real wins. Here is what those first months should actually look like, and what really happens in them.
Zero Trust without buying anything.
You got told you need Zero Trust and priced it like a product. For most small companies it's a configuration project, not a purchase, and you already own most of the parts.
PIPEDA vs Law 25: what Canadian small businesses actually have to do.
Someone said the words "Law 25" and now there's a knot in your stomach. What PIPEDA and Quebec's Law 25 actually require about moving your data, in plain English, minus the legalese and the panic.
AI compliance without sending your data to the cloud.
Almost every 'AI-powered' compliance tool reads your documents by shipping them to a model in someone else's cloud. For compliance evidence, that's the one place it shouldn't go. Here's why local inference changes the math, and how to check where your data actually ends up.
Why we keep recommending self-hosted.
Everything is SaaS now, so why do we build our compliance tools to run on your own infrastructure? Because for compliance data, residency isn't sovereignty, and a vendor's badge doesn't change whose government can reach your data.
The SOC 2 timeline that's actually realistic.
Type 1 in a few months, Type 2 in 6 to 12. Here's the honest SOC 2 timeline, phase by phase, and why no tool shrinks the part that actually takes time.
NIST CSF 2.0: what changed and why it matters.
NIST CSF 2.0 added a sixth function called Govern. Here's what changed from 1.1, why it matters, and whether you need to redo your assessment.
How we write here.
A short explainer on what to expect from MALTO Cyber field notes — one email a month, plain language, written by practitioners who do the work.