Purple team exercises are my favorite work when they go well. Few things burn me out harder than when they're set up to fail and I have to run them anyway. I wrote up the specific failure modes I've seen repeatedly, on both the client side and the consulting side. 🧵

Physical security assessments aren't about stopping Hollywood-style heists—they're about identifying the everyday vulnerabilities that actually lead to breaches. Read our latest blog about it: empiricsecurity.substack.com/p/oceans-ele...

We’ve all seen it: the "compliance-first" mindset that checks every box while leaving the front door wide open, but out of scope. If you’re tired of the theatre and actually want to move the needle, give this a read. empiricsecurity.substack.com/p/how-shadow...