Practical cyber security
Cyber security advice that doesn't talk down to you.
I'm a cyber security analyst. My day job is triaging security alerts and taking apart suspicious emails — and answering "should I be worried about this?" for people who don't work in tech and shouldn't have to. This is where I write those answers down properly.
Most security advice is written for people who already understand security. It's a wall of jargon, a scare story, or a product pitch — and it leaves you no clearer on what to actually do next.
That gap is the whole reason this exists. The people asking "is this email real?" or "do I actually need a password manager?" are perfectly capable. They've just never been given a straight answer. I get asked those questions most weeks, and the honest answers are almost always simpler than the internet makes them sound.
The approach
Four rules I hold myself to.
These aren't marketing lines — they're the standard everything published here gets held against.
Plain English, always
No acronym goes unexplained. If a sentence only makes sense to someone who already works in security, it gets rewritten.
No scare tactics
Fear sells products and teaches nothing. Risk gets described honestly — including when the honest answer is "this one doesn't really affect you".
One thing at a time
A list of thirty things you should be doing is a list nobody starts. Better to do one properly this week than feel guilty about all of them.
Honest about uncertainty
Security is full of "it depends". Where the answer genuinely isn't clear-cut, that gets said out loud rather than papered over with confidence.
Who's behind it
A working security analyst, not a marketing team.
Day to day I work in a security team — triaging alerts as they come in, investigating email threats, and handling the enquiries that land when something looks wrong on someone's machine. Most of the people behind that queue have never had a reason to learn any of this, and shouldn't need to.
So I spend a lot of time translating. Explaining why a particular email is a fake, or why a scary-looking alert is actually nothing, or what someone should do first after clicking something they wish they hadn't. The same questions come up over and over.
Everything here is written from that vantage point — real alerts, real phishing attempts, and the answers that actually helped.
What I won't do is pretend to certainty I don't have. Where the honest answer is "it depends", that's what you'll get, along with what it depends on.
Stay in the loop
Occasional updates when there's something genuinely worth reading. That's it.
Your email address and the date you gave it — that's everything stored, and it's only ever used to send you these updates. Never shared, never sold. Unsubscribe any time by replying or emailing me. Full privacy policy.
contact@staycybersafe.online