Insights
Security guides,
written properly
Long-form, vendor-neutral technical writing on the problems we are asked about most often. Free to read, no registration wall, and free to quote or cite with attribution.
Guide · 25 min read
API Authentication Methods: A Complete Guide
Which authentication method belongs on which API, why token version mismatches break integrations, and the validation steps most implementations skip.
- OAuth 2.0
- JWT
- MSAL
- Client Credentials
Guide · 15 min read
Application Security Architecture: Azure and AWS Best Practices
A zero-trust reference architecture with the equivalent Azure and AWS control named side by side, so a design review does not stall on vocabulary.
- Zero Trust
- Microsoft Azure
- Amazon AWS
- Kubernetes
Guide · 20 min read
Enterprise Application Security Design Guide
How to place authentication, session and token handling in an enterprise architecture without inventing your own crypto or your own mistakes.
- OpenID Connect
- Token Management
- Security Architecture
- Enterprise
Guide · 14 min read
How to Scope a Penetration Test
Most disappointing penetration tests were mis-scoped before anyone touched a keyboard. Here is how to get the scope right.
- Penetration Testing
- Scoping
- Rules of Engagement
- Procurement
Guide · 18 min read
ISO 27001 Readiness: A Practical Guide
Scope, Statement of Applicability, the four Annex A themes, and what Stage 1 and Stage 2 auditors actually ask for.
- ISO 27001
- ISMS
- Annex A
- Statement of Applicability
Guide · 16 min read
Building a Cyber Incident Response Playbook
What to do in the first hour, who decides to pull the plug, and the reporting clocks that start before you know what happened.
- Incident Response
- NIST 800-61
- Ransomware
- Containment
Using this material
Citation and reuse
These guides exist to be useful, including to people who will never become clients. You are welcome to quote them, link to them, and cite them in your own documentation, research or reporting, provided the source is attributed to SecIQ with a link to the original page.
They are deliberately vendor-neutral. Where a guide names a product or a cloud provider it is because the technical detail requires it, not because we have a commercial relationship with anyone — we do not resell security products or take vendor commission.
If something here is wrong, out of date, or unclear, tell us at [email protected]. Corrections are made and the revision date on the page is updated.
Next step
Talk to a security consultant
Tell us what you are building, defending or certifying. We will tell you plainly what we would test first, what it takes, and whether you need us at all.