Notes from running Linux servers in production.
Practical guides from building and running SecAI: detection engineering, hardening, and what actually works.
How to Detect a Cryptominer on a Linux Server
Cryptojacking is the most common outcome of a compromised Linux server. How to find a miner, and why checking CPU usage misses the careful ones.
What the SecAI Agent Actually Does on Your Server
A specific account of what the SecAI agent installs, what it reads, what it sends, what it can change, and what it deliberately cannot do.
How to Tell if Your Linux Server Has Been Compromised
A triage sequence for a Linux server you suspect is compromised: what to check, in what order, and what to do before you start cleaning.
Enterprise EDR vs a Linux Agent for Small Teams
Enterprise EDR is built for laptop fleets with a SOC behind it. What that means when you have eight Linux servers and no analyst.
Detecting Privilege Escalation on a Linux Server
How attackers turn a low-privilege foothold into root on Linux, which artefacts that leaves behind, and how to detect escalation rather than discovering it later.
How Automated IP Blocking Works, and How It Goes Wrong
Automated IP blocking is easy to switch on and easy to get wrong. Why block scope matters more than accuracy, and how to avoid locking yourself out.
Why Manual Server Monitoring Fails at 3am
What an automated agent does that a skilled Linux administrator cannot, what the administrator still does better, and why the gap is attention not skill.
Wazuh for Small Teams: The Operating Cost Nobody Prices In
Wazuh is free to licence and expensive to run. What the manager, the indexer and the rule tuning actually cost a team without a security engineer, and how to decide if that trade works for you.
AI Linux Server Security: What the AI Actually Does
AI-driven Linux server security is marketing until someone says which decisions the model makes. What AI is genuinely good for on a server, and what it is not.
Linux Server Security as a Service: A Buying Guide
What you actually get when you buy Linux server security as a service, which vendor claims to check, and where the model genuinely breaks down.
Linux Server Security Software: A Complete 2026 Guide
What linux server security software actually needs to do in 2026 - real-time IP blocking, honest DDoS scoping, and NESA/PDPL reporting that survives an audit.
Server Security Requirements for UAE NESA and PDPL Compliance
What UAE cybersecurity and data protection frameworks expect from your server infrastructure, and how to produce the evidence.
A Practical Linux Server Hardening Checklist for Small Teams
A Linux server hardening checklist for what to actually do on a new production server, in priority order, when you do not have a dedicated security team.
Detecting DDoS: Layer 4 and Layer 7 Floods on a Linux Server
DDoS on Linux, the difference between a SYN flood and an HTTP flood, how to spot each from the server, and what a host-based agent can and cannot do about them.
How to Track CVEs for the Packages Installed on Your Linux Servers
Knowing which vulnerabilities actually affect your servers, rather than reading CVE feeds and hoping. A practical approach using OSV data.
How MSSPs Add Clients Without Adding Analysts
The unit economics of managed security, and why alert triage is the constraint that decides whether a security practice scales profitably.
How to Stop SSH Brute Force Attacks on a Linux Server
What a brute force attempt looks like in your logs, how to block it automatically, and why blocking alone is not enough.
What File Integrity Monitoring Actually Catches on Linux
File integrity monitoring (FIM) is on every compliance checklist and poorly understood. Here is what it detects, what it misses, and how to run it without drowning in alerts.
SSH Hardening Checklist for Production Linux Servers
Ten changes that remove most of the SSH attack surface on a Linux server, in the order worth doing them.
fail2ban vs CrowdSec, Which Should You Run on Your Linux Server
fail2ban and CrowdSec both block malicious IPs, but solve the problem differently. A practical comparison for anyone securing a production Linux server.
How to Detect a Webshell on a Linux Server
Webshells are one of the most common ways attackers keep access to a compromised Linux server. Here is how to find them, and how to catch the next one automatically.