Reading a Solicitation for Security Requirements Before You Bid
Most small contractors read a solicitation the way they read a car lease: the price, the term, the part about what they're actually getting,...
One byte at a time
CMMC, AI & Cybersecurity Insights for Small Business
Practical guidance on CMMC and compliance, AI agents that actually earn their keep, and the security decisions small defense contractors face for real — plus the technical notes we keep from our own lab. Pick a category below to narrow things down.
CMMC for Manufacturers: A Space Coast Shop Floor Guide
The Space Coast is a defense supply chain that a lot of people drive past without noticing. L3Harris has its headquarters in Melbourne. Northrop...
You Don’t Need to Learn AI. You Need to Lead It.
A lot of executives worry they've fallen behind on AI, and many have the same plan to fix it: take a course, learn to...
Securing Your LinkedIn Account Against Attacks and Scams
LinkedIn is the one social network most defense contractors treat as safe. It's professional, it's where the recruiters are, and it feels like a...
The False Claims Act Exposure in Your SPRS Score
Most small contractors think about their SPRS score as a gate. You need a number posted to win the contract, so you post a...
Why I Built Noble Search, and Why the Public Version Is Free
I built Noble Search because I needed it. Then I decided to give the public version away. This post covers both halves: why it...
AI Is Not Going to Kill You (Probably)
Every few months another article makes the rounds explaining how artificial intelligence is going to end the human race. Sometimes it's a headline, sometimes...
CUI vs FCI: Telling Them Apart in Your Own Contracts
The definitions are not hard. FCI is non-public information provided by or generated for the Government under a contract. CUI is information that a...
DFARS 252.204-7012 in Plain English
Most of the anxiety in the defense industrial base right now is aimed at CMMC. That is the wrong target. CMMC is an assessment...
Automating Compliance Evidence Collection
The two weeks before an assessment look the same everywhere. Somebody is taking screenshots. Somebody else is trying to remember whether the account review...
Is Your Prompt History a CUI Spill?
I have written already about whether you can use AI tools if you handle CUI, and about what it takes to run AI inside...
Finding Your First Prime Relationship
Nobody at a prime wakes up wanting to add a supplier. Adding you creates work for a buyer, a quality engineer, a lawyer and...
Level 1 vs Level 2: Which Actually Applies to You
The question I get most often from shops under fifty people is some version of "we're only Level 1, right?" It is almost always...
Writing an SSP That Survives Scrutiny
Every assessment I have watched go badly went badly in the first hour, and it went badly for the same reason: the assessor could...
Bid/No-Bid Decisions for Small Defense Contractors
Most small contractors I work with do not have a bid/no-bid problem. They have a saying-yes problem. The pattern is always the same. A...
Star Trek: The Next Generation as Leadership Training
TNG is a mediocre action series and an excellent leadership curriculum, for the same reason: it spends its time in the conference room.
AI in a CMMC-Scoped Environment: What’s Actually Allowed
In a companion post I argued that the question "can we use AI if we handle CUI" is the wrong one, because the rules...
Can You Use AI Tools If You Handle CUI?
I get this question more than any other right now, and it usually arrives in a slightly panicked tone: "We handle CUI. Are we...
POA&M: What Belongs on It and What Doesn’t
The plan of action and milestones is the most misunderstood document in CMMC, and the misunderstanding runs in a specific direction. People treat the...
SPRS Scoring Explained: How the Number Is Calculated and What It Signals to Primes
A prime asks for your SPRS score. You look it up, read back a number, and hope that is the end of it. It...
CUI Scoping: The Decision That Determines Your Entire CMMC Budget
Most CMMC conversations start in the wrong place. They start with controls. MFA, logging, encryption, the 110 requirements in NIST SP 800-171. Those matter,...
How Much Does CMMC Compliance Actually Cost?
Every consultant answers this with "it depends." That is true and useless. So let me give you the actual numbers — the Department's own...
Is CMMC Cancelled? What the July 2026 Suspension Actually Means
No. CMMC is not cancelled. It is suspended in part, under review in whole, and still legally on the books. Those are three different...
A Headless Bridge: Live-Syncing an AI Agent’s Workspace into CouchDB
Most Obsidian sync stories end at "install the plugin, point it at CouchDB, done." This one starts where that leaves off: there is no Obsidian.
CMMC Isn’t Dead. It’s Changing. Here’s What Every Defense Contractor Needs to Know.
CMMC and Cybersecurity compliance is still very much a requirement.
Your Security Stack Is Not Your Security Strategy
Most small businesses do not have a cybersecurity tool problem. They have a leadership rhythm problem. Learn how a practical security operating rhythm reduces...
From 20.04 to 24.04 Without Losing Sleep: A Real-World GCP VM Migration
A practitioner’s account of moving a production Docker host to a newer OS — what worked, what bit, and what we’d do again.
If You Don’t Have an Agent Strategy, You Don’t Have a Strategy
Real agent strategy starts with a hard question: which parts of your business can be handed off to an autonomous system with zero human...
The World Wide Web Didn’t Ask for Permission. Neither Will Agents.
The internet existed before that, HTML existed before this, but the Web made information sharing frictionless and accessible.
A Hammer Doesn’t Swing Itself. An Agent Does.
Most organizations start with tool adoption because it feels safe. You keep humans in the loop. You can always intervene. That’s also why tool-only...
How AI Agents Are Redefining Workforce Economics
I Hired a Team You Can't See: How AI Agents Are Redefining Workforce Economics Last month, I deployed three new team members into CyberCloudAI's...
Back Up n8n workflows in Docker: A Practical Walkthrough (+Git)
This guide is ideal for anyone running n8n in Docker Desktop and wants a clean, version-controlled backup process. While simple, this process assumes you...
Proudly Certified as a Service-Disabled Veteran-Owned Business (SDVOSB)!
We are incredibly proud to announce that our company has achieved certification as a Service-Disabled Veteran-Owned Business (SDVOSB) by the U.S. Small Business Administration...
Black Friday Deals, Cyber Risk Decisions: What Leaders Need to Know
Leaders should treat Black Friday and holiday tech refresh as a cyber change event, not just a shopping season.
Supercharge Your Terminal: A Guide to the Gemini Command-Line Interface Tool
The Gemini CLI is more than just a chat interface; it's an AI agent that can take actions within your project.
Meet Terry: The 15-Cent Network Engineer Who Never Sleeps
At a cost of roughly 15 cents a day, AI automation Terry now performs work that once required a full-time human engineer. He's learning...
Massive Sim Farm seized by the US Secret Service…
The Secret Service quietly dismantled a hidden telecom network across New York on the eve of the U.N. General Assembly. A cyber threat you...
Create a Discord trigger for n8n
Wiring a Discord channel into n8n so a chat prompt fires an AI workflow and drops the result back in the channel. Advanced-user setup,...
From Automation to Autonomy: Agentic AI for Business Agility
Automation follows instructions. Autonomy makes decisions. What actually changes for a small business when AI workflows start thinking a few steps ahead.
Add a Cloudflare Tunnel to a Docker Container
Reach a home-lab or on-site container from the internet without opening a single inbound port. A practical walkthrough of putting a Cloudflare Tunnel in...
Fix WordPress “content can’t be displayed” error
A fresh WordPress install that will not let you edit anything is usually a Content Security Policy problem in the web server, not a...
Absolute Docker Volumes
Docker volumes are not limited to the default path. Using the local driver with a bind mount, you can point a named volume at...
How to Set Up Your Raspberry Pi as a WiFi Bridge
I utilized a Raspberry Pi to bridge my WiFi network to Ethernet, enabling access to my NAS. The process involved configuring networks, enabling IP...
No posts in that category yet.