§ 01Field notes
The nine notes below rest on three things: bench work on our own estate, close reading of published regulatory text, and the roles our people held before they joined the firm. Each note states its basis in the first line. Nothing here is presented as a client engagement. Prior employers are described by type and scale and are never named, and any measurement quoted was taken on our own systems.
§ 02Latest
The register of information is filed, validated and then queried. Two cycles worked earlier in my career, and the feedback published since, put the cost in records rather than in interpretation.
Read the field note
§ 03Archive
Each note names the service line that produced the work, the person who wrote it and the basis it rests on.
The register of information is filed, validated and then queried. Two cycles worked earlier in my career, and the feedback published since, put the cost in records rather than in interpretation.
Sofia Marchetti
Governance, Risk and Compliance
We ran 22 ATT&CK techniques against our own estate and counted alerts rather than rules. Alerts fired on 12, evidence without an alert on 6, and nothing at all on 4. Three of the 12 fired only because they recognised our tooling.
Aleksandra Nowak
Managed Detection and Response
The configuration is published by Microsoft and takes an afternoon to set. The rehearsal is where it fails, and the first fault we found was in our own run book.
Henrik Lindqvist
Identity and Access Management
A scanner scores a vulnerability in the abstract. The ranking that decides what gets fixed first is what a finding reached, from where, and whether anything else in the report depends on it.
Rania Haddad
Offensive Security
The national implementing acts move supply chain security out of the annex and into the contract. We read the published texts, drafted a clause, and withdrew our first version after our own suppliers read it.
Katharina Vogt
Governance, Risk and Compliance
We declared a total loss of our own primary region and ran the run book as written. The storage was never the problem. The credentials, the run book's own location and DNS were.
Tobias Reinhardt
Continuity and Disaster Recovery
Two PCI DSS requirements have been mandatory since March 2025. We built a conventional payment page in our own laboratory and counted what the browser actually loaded, which was four times what the source suggested.
Sofia Marchetti
Governance, Risk and Compliance
A stolen session token, an inbox rule and a changed bank account. The evidence for all three sits in logs most tenants already hold, and the order you read them in decides what you can prove.
Ifeoma Adeyemi
Incident Response and Digital Forensics
We built one Gatekeeper constraint library and ran it against our own clusters before we would put it in a proposal. Twelve constraints went into audit. Nine we ship. Three we withdrew, and one of those we broke ourselves.
Diego Sotomayor
Cloud and Infrastructure Engineering
§ 04The briefing
The briefing carries new field notes, the regulatory dates worth diarising and what the bench work on our own estate turned up that month. It goes out on the first Tuesday of each month. Subscribing does not add an address to a sales list.
01
New field notes, one regulatory date with the obligation it triggers, and one note from bench work on our own estate.
02
Issues are plain text with links to eigenvector.group. We never attach files. An issue carrying an attachment did not come from us.
03
We send the briefing on the basis of your consent. Every issue carries a working unsubscribe link, and one click ends it. Our privacy notice sets out retention and your rights.
04
Addresses are held in the United States, processed only to send the briefing, and never sold or passed to anyone outside the firm and its email provider. To be removed by hand rather than by link, write to enquiries@eigenvector.group.
§ 05Next step
Send an outline of the estate, the regulatory deadline you are working to, and the date you need cover in place. The first scoping call carries no fee; a baseline assessment, if one follows, is fixed-fee against a written scope. Every enquiry is answered by a named person within one working day.