Featured1 min read
Detecting phishing before it reaches your employees
Most phishing that gets through is not sophisticated. It is fast. A practical layered setup for a 50-person company.
Press passNo. 0005Tomás Reyes
Principal Security Engineer
Security engineer at Halden. Email security, phishing programmes and the controls small companies skip.
Lisbon, PortugalMember since Apr 2026
- articles
- 5
- reads
- 5.8K
- other work
- 0
aqvil.com/@tomas-reyes
- First article
In Tomás’s words
Former incident responder, now running Halden's advisory practice for companies between 20 and 500 people. I care about controls that get implemented over controls that get recommended.
On Aqvil since Apr 26, 2026 · Lisbon, Portugal
Guide1 min read
The five email security controls that stop 90% of incidents
Ranked by the incidents we have actually responded to, not by how they are usually marketed.
Featured1 min read
What a tabletop incident response exercise actually looks like
A step-by-step walkthrough of the two-hour exercise we run with clients, including the scenario we use and where teams usually get stuck.
Analysis1 min read
Why your MFA rollout probably has a gap
We have audited over 60 companies that believed MFA was fully enforced. Fewer than ten actually were.
Research1 min read
The phishing simulation email that got the best (and worst) results
We ran the same simulation across 40 client companies. The results changed how we design every simulation since.