Reading severity without drowning in noise
How Hong Kong SOC desks can keep severity language honest when alert volume spikes during regional campaigns.
Journal
Field notes for incident reporting and SOC analytics
Practical writing from engagements — severity, handoffs, board questions, and weekly review metrics — not generic transformation essays.
What belongs in an incident report — and what can wait
A practical section order for cybersecurity incident reporting when legal, insurance, and operations all want different details.
Handoff views that survive a busy night
Design notes for shift-change summaries that still work when the queue is deep and attention is short.
Board questions after a breach scare
The questions directors in Hong Kong typically ask — and how SOC evidence should answer them without theatre.
Choosing metrics for weekly SOC reviews
A shortlist of measures that help duty managers improve practice without turning the weekly meeting into a vanity chart session.