Week 1 of 31 Days Safer, one layer deeper. The daily tips gave you the moves; this post gives you the why — how credential stuffing, SIM-swapping, and social-media recon actually work, and why your accounts are a chain attackers pull at the weakest link. Non-technical, but technically accurate.

What I'm building this October: two anchor projects — the 31 Days Safer challenge and an open-source detection skill that maps alerts to MITRE ATT&CK — plus an "open workbench" where Hacktoberfest's weekly challenges are letting me explore what else I can build within the brand.

There are a hundred cybersecurity challenges this October, and most are the same checklist. This one's different: it teaches the reason behind every habit, not just the rule — the "does this belong here?" detection lens a SOC analyst uses on every alert, aimed at your own digital life.

Everyone knows not to click the link — but nobody explains why. 31 Days Safer is a month-long digital hygiene challenge that gives you one small security habit a day, plus the threat behind each one. Free tracker included. Small steps for a safer digital life, from DataSec Chronicles.

Hacktoberfest changed this year — no more counting pull requests, it's about building with open-source AI. So I'm writing an open-source skills.md that maps a security alert to the MITRE ATT&CK framework: the daily reasoning of a SOC analyst, packaged in public. Here's the plan, out loud so I finish it.

I don't trust vibes. I trust data. So instead of saying summer "went well," I pulled the receipts — certs, tools, investigations, posts — and found the most consequential things I built were never on the roadmap.

You already have the analytical muscle memory cybersecurity hiring managers are looking for — you just describe it in the wrong dialect. Here's how to translate years of SQL, anomaly detection, and log work into the language SOC teams actually hire for, plus a two-question test to audit your own resume: which experience transfers, and which gaps you still need to build.

There's no content team behind DataSec Chronicles. There's just me, a full-time career, a family, and a lot of open tabs. Here's how I actually build all of this — and what I'd tell anyone asking where to start.

On June 20, 2026, my ISC2 CC exam session ended at 90 questions — with time still on the clock and no error message. ISC²'s own CAT documentation puts the minimum at 100 items. I'm a data analyst, so I did what I do when something terminates outside its expected parameters: I went looking for the data. Here's what turned out to be noise, and the one thing that didn't.

Turning raw findings into a threat intelligence report doesn't have to be intimidating. This post walks through mapping a Mirai botnet to MITRE ATT&CK — and explains every tag in plain English, so you can speak the language every SOC team uses.

Attackers don't log off for fireworks. Holidays don't weaken systems — they change how humans interact with them. And that's usually where risk quietly creeps in.

Small utilities have operated under a comforting assumption for years: 'We're too small for anyone to target.' The data says otherwise. Attackers don't need to know who you are — they just need your IP address to show up in an automated scan.

I finally opened TryHackMe — and Module 1 hit differently than I expected. Three rooms, one mystery chest, and a data analyst moment I didn't see coming. Here's what I found in Offensive Security, Defensive Security, and Search Skills through a data analyst's eyes.

The domain I was most afraid of — Network Security — was the one I passed. The ones I felt confident in came back below proficiency. Here's what that taught me about how the ISC2 CC actually tests you.