Prompt injection is the new SQL injection, and we test for it
Any system that lets a language model read untrusted text has a new class of vulnerability. Here is how we test before launch.
Blog
Security posts
HQT blog posts on security for public agency technology teams.
Patching is boring, and that is the point
A repeatable patch process beats any security product an agency could buy.
Notes on rolling out passkeys to a workforce
Phishing-resistant sign-in is finally practical for ordinary staff. What goes smoothly, and what needs planning.
Running a ransomware tabletop exercise with city leadership
A two-hour exercise format that gets department heads and elected officials ready for a bad day.
Zero Trust without buying a Zero Trust platform
Zero Trust is a set of design choices, most of which agencies can make with tools they already own.
Run the tabletop for an outage, not just a breach
A tabletop built around a failed migration or a vendor outage tests decisions a ransomware scenario never reaches.
A SOC 2 report is evidence, not a certificate
SOC 2 reports are long, but the four places that should change an agency procurement decision are short and specific.
A one-page Zero Trust progress report for a council or board
Governing bodies fund what they can see. A simple format for showing security maturity over time.
CJIS for software teams: what actually changes when you touch criminal justice data
A practical summary of the CJIS Security Policy requirements that affect developers and integrators.
Publish DMARC at reject, then keep the callback rule anyway
SPF, DKIM, and DMARC in plain terms, a sequence for reaching enforcement without breaking mail, and the fraud none of them touch.
If you only do one security project this year, make it multi-factor authentication
Why MFA everywhere is the highest-value control for a small agency, and how to roll it out without a revolt.
Design audit logs around the questions you will be asked
Audit logging works best designed backward from the few questions auditors ask, with retention set by policy rather than by tool defaults.