Insights · Field notes

Written by the people who do the work.

Practitioner explainers with real detail. Each note opens with the answer, states its sources in full, names its author and carries its dates. Where a number exists we cite it; where it does not we make the point without one. Thin generalities are not published.

01 · 40 notes

Growth and AI visibility

Why answer engines changed demand, in five sourced numbers: The shift from ranked links to generated answers is measurable. Here are the figures we use when a client asks whether this is real.
How ChatGPT chooses which pages to cite: What is observable about retrieval and citation in ChatGPT, what is documented by OpenAI, and what that implies for a page that wants to be named.
What Google AI Overviews actually do to click-through: The measured effect of a generated summary on clicks to ordinary results, and what to do about a page that depended on those clicks.
AI Mode and the 93 percent zero-click session: On Google’s conversational surface the answer is the whole experience. What the Semrush measurement shows and what it changes.
Why pages ranking 21st get cited more than pages ranking 1st: Almost 90 percent of ChatGPT-cited pages sat at Google position 21 or worse. The reason is not a quirk; it is how retrieval works.
Freshness as a citation factor: what 16.9 million citations show: Ahrefs measured AI-cited URLs as about 25.7 percent fresher than organic results. What that means for a refresh cycle, and what it does not mean.
Why product and service pages dominate B2B citations: XFunnel found product and service content accounting for 46 to 70 percent of AI citations. The pages most firms treat as brochures are the ones engines quote.
The difference between being mentioned and being cited: Two different outcomes in a generated answer, two different causes, and why the pattern between them tells you what to fix.
What a prompt set is and how to build one: The defined, versioned list of buyer questions that AI visibility is measured against, and the method for building one that measures your buyers rather than a market.
How to measure AI share of voice without fooling yourself: Engines are non-deterministic, citations vary by surface and a screenshot proves nothing. The method that makes the number mean something.
Entity consistency: the unglamorous foundation of GEO: Before an engine can cite you it has to know who you are. Most organizations have never checked whether their facts agree across the web.
Why your author pages matter more than your blog: A hundred unsigned posts attribute nothing. One verifiable expert profile changes what every signed page is worth.
llms.txt explained: what it is, what it is not: A root text file that describes the site to language models. Cheap, harmless where ignored, and widely misunderstood.
Which AI crawlers exist, what they respect and how to log them: The named agents behind the major engines, what each is for, which robots.txt token governs it, and the only way to know whether it arrives.
Why JavaScript-rendered content is invisible to most AI crawlers: A page that looks complete in a browser can be an empty shell to the system deciding whether to cite it.
Cloudflare’s default AI crawler block and how it silently removes you from answers: A sensible default for publishers who want to withhold content from training is a silent exit from citations for organizations that want to be found.
Schema that retrieval systems actually use: Of the hundreds of schema.org types, a handful matter for being identified, attributed and cited. The rest is decoration.
Why thin location pages now hurt you: Fifty pages that differ only by city name were once a tactic. They are now a liability for rankings, for citations and for the entity.
How to structure a comparison page engines will quote: Structured comparisons are the format answer engines lift most often in commercial queries. The structure is the point.
The 60 to 120 day citation lag and how to plan around it: Published pages do not earn citations the week they go live. What we observe in engagements, and why the plan should expect it.
What makes a page citable: Five properties that the pages engines cite have in common, and that the pages they ignore lack.
Why named authorship is non-negotiable: Engines, buyers and regulators all ask the same question of a page: who is responsible for this? A page with no answer is not published.
Verification: the difference between content and evidence: Content says things. Evidence says things it can support. The step between them is the one most publishing programs skip.
Refresh cadence: why 180 days is the outer limit: Every page we publish is reviewed within six months at most, and sooner where the subject moves. The reasoning behind the number.
How language editions multiply citation surface: Buyers ask engines in their own language, and engines cite sources in that language. A reviewed edition is a second set of pages that can be cited.
Why a flat fee changes what a paid-media partner recommends: The advice you receive about advertising spend is shaped by how the adviser is paid. Remove the conflict and the advice changes.
Governing Google Ads against evidence, not habit: Most accounts are run the way they were set up years ago, by people who have since left. Governance means every setting has a reason and a record.
Cost per qualified inquiry versus cost per click: One measures what the platform charges. The other measures what the business gets. Only one of them belongs in front of a decision-maker.
Landing paid traffic on authority content: Thin landing pages built for ads bounce, cost more and convert less than the pages that actually answer the searcher’s question.
When to keep paid search running indefinitely: The mandate to cut paid spend as earned demand grows is not a mandate to cut it to zero. Some spend earns its place for good.
Static sites and why they win on speed, security and crawlability: Finished HTML served from the edge has no application to attack, no script to wait for and nothing a crawler cannot read.
Migrating a WordPress practice site without losing rankings: Visibility is lost in migrations through broken redirects, missing content and metadata left behind. Each is preventable with an inventory and a map.
Core Web Vitals on a phone in a parking lot: The visitor who matters is on a phone, on a weak connection, deciding whether to call. The page has about a second.
Privacy-respecting analytics for regulated practices: A medical, legal or financial practice can measure what it needs without sending visitor behavior to advertising platforms. Regulators now expect it to.
Third-party tags as an unmanaged attack surface: Every script loaded from another domain runs with the page’s privileges. Most sites cannot say who added theirs or what they do.
Video transcripts as citation assets: The video builds the expert’s identity. The transcript is what the engines read, cite and attribute.
Original research: the strongest citation magnet: A number nobody else has, with a stated method, must be attributed by everyone who uses it. Nothing else in a content program has that property.
Digital PR for citations, not for links: The sources engines trust are often not your site. Being present in them, with substance and under the expert’s name, is the point.
What boards should ask about AI visibility: Directors are asked to oversee how the organization is found and described by systems they rarely see. Four questions make the oversight real.
Reading an AI visibility report: a guide for executives: What each figure in the monthly evidence report means, what to be suspicious of, and the one question to ask about every number.

02 · 30 notes

Security assurance and compliance

Internal confidence is not evidence: The team believes the controls work. The auditor, the insurer and the customer need something they can examine.
What independent assurance means in practice: Independence is a structural property, not a compliment. What it requires of the examiner, and why third parties will accept nothing less.
Control validation versus control existence: A control that is installed, configured and documented can still fail to do anything. Validation is the test that it does.
How to prepare evidence an auditor will accept the first time: Auditors reject evidence for predictable reasons. Each is avoidable before the audit begins.
ISO/IEC 27001 readiness in twelve weeks: what is realistic: Twelve weeks is enough to be ready for a certification audit under specific conditions. Without them it is a timeline for disappointment.
CMMC Level 2: the controls that catch contractors out: Most contractors fail assessment on a small set of requirements they believed they met. The pattern is consistent enough to prepare for.
NIST SP 800-171 gap assessments: common findings: Across contractors of different sizes, gap assessments against 800-171 turn up the same families of findings. Knowing them shortens the work.
NIST CSF 2.0: what the Govern function changes: Version 2.0 added a sixth function and put it first. The change is a statement about where security programs fail.
Customer security questionnaires: answering once, properly: Every enterprise customer sends a different questionnaire asking the same questions. Answer accurately once and the rest becomes assembly.
Vendor security assessments that do not waste everyone’s time: Three hundred questions to every vendor assesses nothing. Proportion to consequence, read the evidence, and reserve depth for the vendors that matter.
Third-party risk reviews for small suppliers: The supplier with four staff and standing access to your systems is a bigger risk than the enterprise vendor with a SOC 2 report. Review them in proportion.
Executive risk reporting that leads to decisions: A vulnerability count is not a risk report. Executives need to know what could stop the business, how exposed it is and what they are being asked to decide.
Security posture reviews: scope, cadence, output: What a posture review covers, how often it should run and what it should hand leadership at the end.
Why most vulnerability programs produce findings and not fixes: The scanner runs every week and the count never falls. The program is measuring discovery when it should be measuring closure.
SIEM without the noise: what to log and why: A SIEM that ingests everything and alerts on everything is ignored. Decide what you need to detect, then log what detects it.
Endpoint protection oversight for distributed teams: The devices are at home, in coffee shops and in client offices. Protection exists only where it is deployed, configured and acted on.
Identity and access monitoring: the controls that matter: Most breaches involve an identity. The handful of identity controls that detect and contain them are worth more than the rest of the stack.
MFA and phishing-resistant authentication: planning the move: Conventional MFA is the floor. Attackers clear it routinely. Moving to credentials that cannot be relayed is a sequence, not a switch.
Privileged access management for mid-sized organizations: Administrative accounts are the attacker’s objective. Managing them does not require an enterprise platform; it requires knowing where they are and removing standing privilege.
Network segmentation without disrupting operations: A flat network lets one compromised workstation reach everything. Segmenting it is a sequence of observed, tested, reversible steps.
Secure remote access after VPNs: The VPN put remote users on the network. The replacement puts them in front of the application they need and nowhere else.
Device posture and conditional access: Valid credentials on an unmanaged, unpatched laptop should not open the finance system. Posture is the control that says no.
Data classification you can actually enforce: A five-level scheme with a forty-page handbook is never applied. Three levels, clear examples and technical enforcement where it counts.
Secure enclaves for sensitive workloads: Confine the sensitive work to a defined environment and only that environment has to meet the strictest standard, and only that environment gets assessed.
Incident response planning that survives contact with an incident: Most plans are long documents nobody can run at two in the morning. A plan that works is short, specific about authority, and rehearsed.
Tabletop exercises: designing one that teaches: A tabletop that confirms everyone did well has taught nothing. Design it to find the gap that would have hurt.
Ransomware readiness: the five controls that decide the outcome: Whether a ransomware event is a bad week or the end of the business is decided before it happens, by five controls.
Evidence preservation during an incident: The instinct is to fix it. The first actions of a well-meant response are often the ones that destroy what the insurer, the regulator and counsel will need.
Working with legal, forensic and insurance partners during a breach: Four parties arrive in the first day with different priorities. Knowing what each needs, and in what order to call them, is part of readiness.
Post-incident control review: closing the loop: The incident is over when the controls that let it happen have changed and the change has been verified. Not before.

03 · 20 notes

Infrastructure and resilience

Backup validation: proving restores, not backups: Every backup job succeeded last night. That proves a copy was written. It proves nothing about whether the business can come back.
Disaster recovery planning for environments that cannot pause: Some services cannot stop for a recovery test, a failover or a rebuild. The plan has to be designed and proven around that constraint.
Business continuity for critical-service operators: For an operator the public depends on, continuity is a promise made to people who did not choose to rely on it. The plan is owned by the business, not by IT.
Recovery testing cadence and evidence: How often to test what, and what the record has to contain for the test to count as proof.
Hardware lifecycle risk in aging data centers: Equipment past vendor support fails without warning, cannot be patched and often cannot be replaced quickly. Age is a risk that can be inventoried and planned.
Remote hands and smart hands: coordinating field work securely: A technician you have never met is about to touch your equipment because someone sent an email. The request process is the control.
Secure maintenance windows: Maintenance is when controls are loosened on purpose. Most incidents traced to maintenance come from a window that never properly closed.
Asset and configuration review as a security control: Every control assumes you know what exists and how it is set. Most organizations are guessing at both.
Data center operational support under contract: Operational support is only as good as the terms it runs under. The contract defines the standard, the evidence and the escalation.
Multi-location operational support: standards and escalation: Twelve sites, four providers, one standard. The standard is written once; the escalation path is what makes it hold.
Resilience metrics boards understand: Uptime percentages and backup success rates do not tell a board whether the business would survive a bad day. Five measures do.
Continuity obligations in government contracts: A government contract can make continuity a legal obligation with reporting deadlines, not a best practice. Read the clauses before the outage.
Infrastructure dependencies you did not know you had: The service fails because of something three steps removed that nobody drew on the diagram. Dependency mapping finds it before the outage does.
Power, cooling and the security team: A failed chiller takes down more systems than most attacks. Environmental controls belong in the security program, not in a separate building.
Physical access control as part of the control set: Every logical control assumes the attacker cannot simply walk to the server. Physical access is assessed, evidenced and reviewed like any other control.
Uptime as evidence: A claimed availability percentage is marketing. Measured availability with the method stated, the incidents listed and the recovery proven is evidence.
Change management in high-consequence environments: Where a bad change stops a hospital, a plant or a trading floor, the change process is the control that matters most and the one most often bypassed under pressure.
Vendor outages and your continuity plan: Your plan recovers your systems. The outage is at your cloud provider, your payment processor or your identity service, and the plan has no page for that.
Testing failover without causing an outage: Redundancy that has never failed over is a theory. Testing it in stages, under observation, with rollback ready, turns it into evidence without taking the service down.
Documenting resilience for insurers: Insurers ask about backups, recovery and continuity in absolute terms. The answer that holds at claim is the one backed by records.

04 · 10 notes

Method and principles

Observe, Fortify, Verify, Evidence, Sustain: the method: Five steps, applied to a control environment or to a growth program, in the same order every time. Here is why the order matters.
Why we deliver under the client’s name: Much of our security work reaches its end client under another firm’s brand. That is a design decision, not a compromise.
Independence as a discipline: Independence is not a quality we claim. It is a set of things we refuse to do so that our findings can be relied on.
Proof over promises: how we write a report: A report is read by people who cannot check the work. It is written so that they could.
Why we do not sell software: Reselling security products is a reliable revenue line for most firms in our field. We decline it so that our advice about products is worth having.
Flat fees and aligned incentives: Our growth plans are a fixed monthly fee with a twelve-month minimum, and our paid-media governance is never a percentage of spend. The structure is the point.
What we decline, and why: A short list of work we do not take, because taking it would make the rest of our work worth less.
How we qualify a growth client: A growth engagement fails for predictable reasons. We check for them before we start, and we decline when they are present.
Why the same firm does security and growth: It looks like two businesses. It is one discipline, evidence under scrutiny, applied to the two things an organization is judged on.
Confidentiality by default: We do not name clients, publish case studies with logos or disclose who we work with. Here is what we publish instead and why.