Week 1 of 31 Days Safer, one layer deeper. The daily tips gave you the moves; this post gives you the why — how credential stuffing, SIM-swapping, and social-media recon actually work, and why your accounts are a chain attackers pull at the weakest link. Non-technical, but technically accurate.

What I'm building this October: two anchor projects — the 31 Days Safer challenge and an open-source detection skill that maps alerts to MITRE ATT&CK — plus an "open workbench" where Hacktoberfest's weekly challenges are letting me explore what else I can build within the brand.

There are a hundred cybersecurity challenges this October, and most are the same checklist. This one's different: it teaches the reason behind every habit, not just the rule — the "does this belong here?" detection lens a SOC analyst uses on every alert, aimed at your own digital life.

Everyone knows not to click the link — but nobody explains why. 31 Days Safer is a month-long digital hygiene challenge that gives you one small security habit a day, plus the threat behind each one. Free tracker included. Small steps for a safer digital life, from DataSec Chronicles.

Hacktoberfest changed this year — no more counting pull requests, it's about building with open-source AI. So I'm writing an open-source skills.md that maps a security alert to the MITRE ATT&CK framework: the daily reasoning of a SOC analyst, packaged in public. Here's the plan, out loud so I finish it.

The comeback half of my SC-900 story. After failing by 32 points, I scored 90% on the Microsoft practice assessment four days later. Here's how I'm closing the gap: letting my score report target the right domain, drilling the formats that beat me, and knowing what each practice source can and can't tell me.

The honest version of my SC-900 exam experience: I scored 668/700, 32 points short. How the online-proctored setup compared to my CC exam, the true/false and drag-and-drop formats that caught me, what my score report revealed, and exactly how I'm approaching the retake.

Tomorrow I sit the SC-900. This morning, I’m taking stock of where my head is — what feels different from my last certification attempt, what the practice numbers taught me, and the calm that comes from knowing I prepared honestly.

Microsoft has a Defender for everything, a SIEM with a sci-fi name, and a Zero Trust philosophy that gets name-dropped into meaninglessness. Here's the SC-900 Security Solutions stack untangled — what each tool does, how Zero Trust, the Defenders, XDR, and Sentinel connect, and where a data mindset already fits.

Nine years in data turned out to be worth more on SC-900 than I expected — but not everywhere. A domain-by-domain walkthrough of all four SC-900 skill areas, mapped honestly to a data-analyst background: what already transfers, what's brand-new, and where my real practice gap still sits.

SC-900 on September 20 is my first online-proctored exam — and after a test-center anomaly ended my first CC attempt, I'm controlling every variable I can. Here's my OnVUE system-test walkthrough, the admission rules that actually matter, and the exam-day checklist I built from them.

The honest middle of cert prep. I scored 62% on a full-length SC-900 practice exam, lost momentum during a busy week, then got it back with targeted drilling. Here are my real numbers, where my misses still cluster (Compliance), the tools I'm using, and my final-week plan.

I added SC-900 to an already-full August — mid-CC-retake, deep in camp season. Here's the honest version: the free voucher I refused to waste, why I swapped down from SC-200, the 40% cold baseline that sealed it, and how two exams became one reinforcing study block.

I booked SC-900 for September — then deliberately didn't set a Security+ date. Here's why the missing date is the strategy, not a lack of one: what finishing the full SC-900 course taught me about pacing and what an honest, unrushed path to Security+ actually looks like.

I don't trust vibes. I trust data. So instead of saying summer "went well," I pulled the receipts — certs, tools, investigations, posts — and found the most consequential things I built were never on the roadmap.

You already have the analytical muscle memory cybersecurity hiring managers are looking for — you just describe it in the wrong dialect. Here's how to translate years of SQL, anomaly detection, and log work into the language SOC teams actually hire for, plus a two-question test to audit your own resume: which experience transfers, and which gaps you still need to build.

My first ISC2 CC exam attempt ended at question 90. On the retake, it ran the full 125 — and I passed. Here's what I did differently, and what's next.

The first time I sat the ISC2 CC, I was writing into a fog — a first attempt at a machine I hadn't touched yet. This time is different. I've been inside the exam, I know the terrain, and the prep this round was targeted at the specific gaps. Here's where my head is the day before Round 2 — grounded readiness, not anxious anticipation. 💜

What to put in a cybersecurity portfolio when you're coming from a data background — how to structure it, what each project signals to a recruiter, and how to know which roles are actually your lane. Plus a free bingo board to start today.

I failed. Except I didn't. When my ISC2 CC exam stopped at 90 questions, the system gave me bogus results. I could have accepted it. Instead, I found the truth. Now I'm going back in on August 15th to prove it.