About
Hi, I'm Katie.
I'm a security analyst. I spend my working life doing incident response in a security operations center — which mostly means being the person who finds out what happened, how far it went, and what to do about it.
katie.jpg, then follow the note in this file
Katie · GIAC-certified incident responder
Safe2Scroll exists because of a pattern I kept noticing. The organizations I work with professionally have budgets, tools, and people whose entire job is watching for trouble. Meanwhile my friends, my family, and every small business I've ever walked into have none of that — and they're facing versions of the same threats.
When those people go looking for help, they find two things. Either enterprise security firms quoting five figures for work scoped to companies a hundred times their size, or automated tools that produce a number between 1 and 100 and a prompt to upgrade. Neither one tells a dental office owner what to do on Tuesday.
So that's what this is. I do the research a professional would do, and then I write it down the way I'd explain it to my aunt — which is to say clearly, without jargon, and without making anyone feel stupid for not already knowing.
What I bring to it
Day to day, I lead incident response work: triaging well over a hundred alerts a week, running around twenty investigations a month, and leading the response when a website or web application gets compromised. I've handled investigations that crossed into HR, legal, and law enforcement territory. I've built detection and automation for insider threat, run tabletop exercises, and spent a lot of time on identity attacks — the authentication and multi-factor bypass techniques that are currently how most real intrusions start.
None of which matters to you directly. What matters is the consequence: I've seen how these things actually go wrong, repeatedly, at close range. So when I tell you a finding is serious, it's because I've watched that exact gap turn into an incident — and when I tell you something is technically imperfect but not worth your weekend, that's worth just as much.
Certifications
I hold GIAC certifications in incident handling (GCIH), cyber threat intelligence (GCTI), penetration testing (GPEN), web application penetration testing (GWAPT), web application defense (GWEB), and security essentials (GSEC).
GIAC certifications are issued by the Global Information Assurance Certification body and require hands-on, practical examination rather than multiple-choice recall. I mention them because when you're deciding whether to hand someone details about your digital life, "trust me, I'm good at this" isn't good enough.
How I work
Six commitments. They're on the website so you can hold me to them.
I diagnose. You decide.
I don't fix what I find, resell software, or take referral fees from anyone. That costs me revenue and buys you a report you can trust, which is the correct trade.
I never need your passwords
Or account access, or remote access to your devices. Every assessment is built from publicly available information and conversation. There is no step where handing over credentials would help.
Every finding is sourced
Each one traces to something I verified myself or something you told me, and the report says which. If I couldn't confirm something, it says that too, rather than quietly rounding up.
No scaring you into buying
Fear sells security badly and it sells consulting worse. If your situation is fine, the report says it's fine. If you shouldn't hire me, I'll say that before you pay.
Only you, only with consent
For individual reviews, I verify that you are the person being researched. I don't take requests to look into anyone else, for any reason, however sympathetic.
Plain language is the product
Any analyst can generate findings. The work is making them understandable to the person who has to act on them. If I can't explain it clearly, it doesn't go in the report.
You don't have to hire me
Most of what protects an ordinary person or a small business is free, and I'd rather you do it than pay me and not do it. Turn on two-factor authentication everywhere that offers it. Use a password manager. Let your devices install their updates. Make sure your backups run by themselves and test one. That's most of the benefit, right there, for nothing.
The newsletter is where I give that away one piece at a time — one concrete thing worth doing, every other week, in plain language. If you read it for a year and never buy anything, I'll consider that a success.