Insights / Articles
Written while building the thing.
Engineering articles from KOR IT. Each one is a position reached while designing or operating the systems described elsewhere on this site — with the architecture drawn, and the limits stated where they exist.
What NIS2 and DORA actually ask of your telemetry
A 24-hour reporting clock is a data architecture requirement before it is a policy one. An engineering reading of what the EU incident-reporting regimes need from a security data platform.
September 2026 · 5 min read
Detection engineering is a software problem
Rule counts measure activity, not coverage. Treating detections as software — with dependencies, tests, owners and a retirement path — changes what a SOC can honestly claim.
September 2026 · 5 min read
The tiering decision: what a security data platform keeps hot
Security data architecture is mostly one recurring decision: which data is searchable in seconds, which is retrievable in minutes, and who is allowed to make the call.
September 2026 · 5 min read
Crypto-agility is an architecture property, not a library upgrade
The hard part of post-quantum migration is not choosing an algorithm. It is that most estates cannot answer where a given algorithm is used, or change it without a release.
August 2026 · 6 min read
An agent needs an identity of its own
Agents that act with a borrowed user token are unauditable and unrevocable. Delegated identity, evaluated at the tool call, is what makes agent actions governable.
August 2026 · 7 min read