Design vs Operating Effectiveness | Free IT Audit Training · Lesson 2

Evidence That Holds Up | Free IT Audit Training · Lesson 3

One Phishing Click as Domain Admin | CISA Domain 5 Lesson 6

They Left Months Ago and Still Log In | CISA Domain 5 Lesson 7

The Badge Reader That Lets Two In | CISA Domain 5 Lesson 8

Hard Shell, Soft Centre | CISA Domain 5 Lesson 9

It Only Alerts, It Can't Block | CISA Domain 5 Lesson 10

Hashing Is Not Encryption | CISA Domain 5 Lesson 11

Strong Algorithm, Key Under the Mat | CISA Domain 5 Lesson 12

The Open Bucket Is Yours, Not the Cloud's | CISA Domain 5 Lesson 13

One Phone Call, One Password Reset | CISA Domain 5 Lesson 14

A Scan Is Not a Penetration Test | CISA Domain 5 Lesson 15

They Wiped the Machine and the Evidence | CISA Domain 5 Lesson 16

DORA for a Fintech: Operational Resilience as a Legal Duty

Network Segmentation and VPN for Critical Infrastructure

SOC 1 for iGaming: Auditing the Financial Database in the Cloud

SOC 2 for a SaaS Provider: The Report Your Customers Ask For

SaaS, OS and Database: Auditing the Full Stack of an e-Gaming Platform

RPO vs RTO: The Exam Swaps Them | CISA Domain 4 Lesson 11

Two Years of Green Backups, None Restorable | CISA Domain 4 Lesson 12

Deleted, and Replicated in Seconds | CISA Domain 4 Lesson 13

Servers Fine, Office Closed | CISA Domain 4 Lesson 14

A Cold Site for a Two-Hour Recovery | CISA Domain 4 Lesson 15

Security Isn't Just IT's Job | CISA Domain 5 Lesson 1

The Brochure and the Merger, Same Lock | CISA Domain 5 Lesson 2

"It's All Encrypted" Isn't Privacy | CISA Domain 5 Lesson 3

Two Passwords Isn't Multi-Factor | CISA Domain 5 Lesson 4

Three Roles, All the Access | CISA Domain 5 Lesson 5

A Monitor Request, Ahead of Payroll | CISA Domain 4 Lesson 1

Restore the Service, Don't Chase the Cause | CISA Domain 4 Lesson 2

The Change With No Approval and No Way Back | CISA Domain 4 Lesson 4

Fixed Every Night, Never Solved | CISA Domain 4 Lesson 3

The Firewall Rule Nobody Approved | CISA Domain 4 Lesson 5

One Step From a Developer's Keyboard to Live | CISA Domain 4 Lesson 6

Failed at 3am, Found the Next Afternoon | CISA Domain 4 Lesson 7

Out of Storage, and Editing Tables by Hand | CISA Domain 4 Lesson 8

The Spreadsheet That Feeds the Accounts | CISA Domain 4 Lesson 9

They Recovered Email While the Business Waited | CISA Domain 4 Lesson 10

Who Owns an IT Project's Benefits? | CISA Domain 3 Lesson 1

Why Bolting Controls On Later Always Fails | CISA Domain 3 Lesson 2

"We're Agile, So There's Nothing to Audit" | CISA Domain 3 Lesson 3

Who Actually Signs Off a New System? | CISA Domain 3 Lesson 4

The Data Migration You Can't Undo | CISA Domain 3 Lesson 5

Big-Bang Cutover With No Way Back | CISA Domain 3 Lesson 6

One Mistyped Number, Three Controls | CISA Domain 3 Lesson 7

A Junior Manager Accepted an Enterprise Risk | CISA Domain 2 Lesson 7

You Outsourced the Work, Not the Blame | CISA Domain 2 Lesson 8

A Thorough SLA Nobody Ever Measured | CISA Domain 2 Lesson 9

Five Thousand Tickets Closed. So What? | CISA Domain 2 Lesson 10

This Compliance Certificate Proves Nothing Today | CISA Domain 2 Lesson 11

Well-Run IT Is Not the Same as Governed IT | CISA Domain 2 Lesson 1

A Dazzling IT Strategy That Serves Nothing | CISA Domain 2 Lesson 2

Which Document Actually Binds You? | CISA Domain 2 Lesson 3

One Person Did All Four. Nothing Caught It. | CISA Domain 2 Lesson 4

A Beautiful Architecture That Governs Nothing | CISA Domain 2 Lesson 5

Three Fixes, Zero Assessment | CISA Domain 2 Lesson 6

The Most Useful Thing an Auditor Must Refuse | CISA Domain 1 Lesson 3

They Explained the Control Perfectly. So What? | CISA Domain 1 Lesson 11

The Audit Finding That Was True and Useless | CISA Domain 1 Lesson 12

Why a Screenshot Proves Almost Nothing | CISA Domain 1 Lesson 10