Blog
Practical notes on vulnerability management, NIS2 and ISO 27001 compliance, and the evidence an auditor actually asks for.
Not everything can be patched right away. How to make a decision you can defend
The fix exists, but installing it would stop a service or break a supplier's application. Deferring an update can be justified by a risk assessment, provided someone made the decision deliberately, other safeguards work in the meantime and there is a review date. Recording the decision alone does not release you from the duty to act. How to do it so the decision still holds up a year later.
- KSC
- NIS2
- Risk
First server: one command and a result in the dashboard
Download the Linux agent, check the first scan and arrange its next run. Why scheduling remains a separate step.
- Linux
- Deployment
800 vulnerabilities, one administrator. What to do this week
A list of hundreds of vulnerabilities usually comes down to a manageable number of packages to update, a few of them truly urgent. How to turn a list that paralyses into a weekly plan you can carry out and defend.
- Vulnerabilities
- Prioritisation
- NIS2
Keep your server names inside the company
What the Linux agent sends, how a custom label changes identification, and why a local preview needs checking beyond its JSON output.
- Linux
- Deployment
An outside IT provider runs your servers? The responsibility remains with you
You can outsource server patching. You cannot outsource overseeing whether it gets done. How to check your provider without being a server expert and without damaging the relationship.
- NIS2
- KSC
- Outsourcing
The board does not need to understand IT. It needs to know whether IT is keeping up
A vulnerability count tells the board nothing. Five process indicators that fit on one page and show whether IT meets its deadlines, without going into technical detail.
- NIS2
- KSC
- Management
NIS2 just landed on your desk. 10 questions to ask your IT team
You do not need to understand servers to check whether vulnerability management actually works. Ten requests to IT that quickly reveal what is an established process and what is just a claim.
- NIS2
- KSC
- Management
NIS2 Article 21: ten measures on one map
Article 21(2) of the NIS2 Directive lists ten measures, from policies to multi-factor authentication. What each of them means, what evidence you can show an auditor, and why a vulnerability management process touches several of them at once.
- NIS2
- KSC
- Evidence
A security policy does not prove that a KSC process works in practice
A mechanism can report a green status while covering a fraction of the scope. The KEV catalogue story on my own fleet, and what it means for operational records.
- KSC
- ISMS
- Evidence
The first KSC audit: who has a 3 April 2028 deadline and when to start collecting evidence
The fixed date of 3 April 2028 applies to one cohort of entities; everyone else counts from their own start. Either way, process history has to emerge during the work.
- KSC
- Audit
- Evidence
What is actually sitting on nine ordinary servers
Raw numbers from my own infrastructure: 165,608 open entries, ninety per cent of them waiting on a fix from the distribution, and three hundred and ten things that can actually be done.
- Vulnerabilities
- Prioritisation
- Data
Cybersecurity outsourcing under Poland's KSC Act: what transfers and what remains
A supplier may perform security tasks, but the regulated entity remains responsible for oversight, risk and evidence.
- KSC
- Outsourcing
- Suppliers
The KSC Act requires software updates, not blind patching
Updates should reduce risk without breaking services. See how to connect vulnerabilities, tests, exceptions and decision evidence.
- KSC
- Patch Management
- Vulnerabilities
Does Poland's KSC Act require an internal SOC? No, but it requires capability
The KSC Act does not mandate an internal SOC. See which monitoring and response capabilities must exist regardless of the operating model.
- KSC
- SOC
- Monitoring
Delegating cybersecurity does not delegate the manager's responsibility
A manager may assign IT work but not statutory responsibility. See what evidence of oversight should remain after delegation.
- KSC
- Management
- NIS2
3 April 2027: what must operate under Poland's KSC Act
Registration is not the end of KSC preparation. See which security processes should operate when the adjustment period ends.
- KSC
- NIS2
- Audit
Is your company covered by Poland's KSC Act? Sector alone is not enough
See why KSC coverage depends on sector, size and corporate links, and why a simple 50-employee test may produce the wrong answer.
- KSC
- NIS2
- Compliance
What a free scanner really costs (TCO worked out on an example)
A zero-cost licence is not a zero-cost process. Work out the total cost of a free scanner on 15 servers, with explicit assumptions you can replace.
- TCO
- Vulnerability management
- Cost
Evidence Pack: how to build a verifiable evidence bundle
Instead of 40 screenshots, one ZIP with a checksum manifest. See the anatomy of a period evidence pack and why a checksum changes the conversation.
- Evidence
- Audit
- ISO 27001
A NIS2 incident: you have 24 hours. What exactly has to happen
Early warning in 24h, notification in 72h, report in a month. See hour by hour what a well-prepared NIS2 incident report looks like.
- NIS2
- Incidents
- Compliance
An end-of-life system is not technical debt. It's a risk register entry
An end-of-life system gets no patches, so it is a risk decision, not a backlog item. See the three things an auditor must see to accept it.
- End of life
- Risk
- ISO 27001
NIS2 Article 20: the board is accountable for cybersecurity. Personally
NIS2 makes the board personally accountable for cybersecurity. See what proof of oversight means and five questions a board should put to its IT team.
- NIS2
- Board
- Compliance
KEV before CVSS: why your patch order is usually wrong
Sorting vulnerabilities by CVSS alone is the default and usually wrong. See why the KEV catalogue should come first and how to build a sensible ranking.
- Vulnerability management
- KEV
- Prioritisation
Are we covered by the Polish KSC Act? Three questions to start with
Check whether your organisation may fall under Poland's KSC Act by reviewing its activity, size and exceptions before seeking legal advice.
- KSC
- NIS2
- Compliance
ISO 27001 A.8.8 in practice: the evidence an auditor will ask for
Control A.8.8 is not about whether you scan. See the questions an ISO 27001 auditor actually asks and which artefacts answer each one.
- ISO 27001
- Audit
- Vulnerability management
A spreadsheet as your vulnerability register: it works until it doesn't
A spreadsheet works as a vulnerability register at small scale, then breaks quietly. See where it cracks and what a real register actually needs.
- Vulnerability management
- NIS2
- Process
NIS2 in Poland: an IT checklist for the 3 October 2026 deadline
A practical checklist for the Polish KSC Act deadlines: self-identification, registration, asset inventory and a vulnerability process that survives an audit.
- NIS2
- KSC
- Compliance
Is free Trivy enough for NIS2 compliance? An honest answer
Trivy finds vulnerabilities for free. Learn when that covers NIS2 requirements and when an auditor will ask for things no scanner output contains.
- NIS2
- Trivy
- Vulnerability management
A scan is a snapshot. Administrators need vulnerability history
The latest scan shows the current state. History shows when a CVE appeared, disappeared, returned and what the team did about it.
- CVE
- Scan history
- Operations
Does this new vulnerability affect any of my servers?
Move from a new CVE alert to a list of affected hosts by checking packages, versions, exposure and available fixes across the fleet.
- CVE
- Linux
- System administration
You received a CVE number. What to check in the first five minutes
A practical way to read a CVE using CVSS, EPSS, KEV, impact and remediation, without losing time across several disconnected sources.
- CVE
- Vulnerabilities
- System administration