andranglin · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026 · Oct 20, 2026
diff --git a/.github/workflows/docs-quality.yml b/.github/workflows/docs-quality.yml
@@ -5,6 +5,7 @@ on:
     paths:
       - '**/*.md'
       - 'scripts/check_docs.py'
+      - 'scripts/check_editorial.py'
       - 'practice-labs/case-studies/**'
       - '.github/workflows/docs-quality.yml'
   push:
@@ -23,9 +24,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - uses: actions/setup-python@v5
         with:
           python-version: '3.12'
+      - name: Check added prose for editorial style
+        run: python scripts/check_editorial.py --base HEAD^
       - name: Validate internal Markdown links
         run: python scripts/check_docs.py
       - name: Validate synthetic case study datasets

diff --git a/contributing/README.md b/contributing/README.md
@@ -4,6 +4,19 @@ Follow the [RootGuard Documentation Design System](../design-system/README.md) f
 
 [Technical Content Review Register](content-review-register.md) tracks prioritised legacy corrections and validation status.
 
+## Writing in plain English
+
+RootGuard is a public technical reference, not an internal status report or marketing brochure.
+
+- Write for a practising analyst or engineer. State the task, prerequisites, procedure, expected observations and limitations without promotional introductions.
+- Use direct verbs such as **inspect**, **query**, **compare**, **preserve**, **verify** and **escalate**.
+- Avoid em dashes in prose. Prefer a full stop, colon, semicolon or a rewritten sentence.
+- Avoid stock phrases such as *ever-evolving threat landscape*, *cutting-edge*, *seamlessly*, *game changer*, *unlock the power of*, *delve into* and *robust solution*. Replace them with a specific claim or remove them.
+- Do not repeat generic warning banners on every page. Put important requirements next to the relevant command or decision.
+- Do not describe examples as comprehensive, complete, validated or production-ready unless the article provides evidence for that claim.
+- Preserve literal syntax in KQL, PowerShell, command output, quoted source material and URLs. Language cleanup must never alter executable logic.
+- Read the final article aloud. Remove filler, repeated ideas and unnecessary adjectives.
+
 ## Publishing principles
 
 - Prefer evidence-based guidance, clear prerequisites and explicit limitations over unsupported claims.

diff --git a/defensive-security/dfir/end-to-end-playbooks/credential-theft.md b/defensive-security/dfir/end-to-end-playbooks/credential-theft.md
@@ -1,8 +1,6 @@
 # Credential Theft: Operational Incident Investigation Playbook
 
-> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready.
-
-**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated.  
+**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. 
 **Review:** 20 October 2026 · **Owner:** SOC/CSIRT · **Authorisation:** Follow local incident command, privacy and evidence procedures.
 
 > **Important:** Queries below are *investigation pivots*, not finished alerts. Microsoft Defender XDR Advanced Hunting and Microsoft Sentinel Log Analytics use different tables and schema. Execute each query only in its stated environment. Preserve evidence, record approvals and do not delay urgent containment when harm is ongoing.
@@ -15,7 +13,7 @@
 4. Preserve relevant logs, incident exports and endpoint artefacts through approved tools. Track collection time, retention gaps and custody.
 5. Keep **observations**, **hypotheses** and **confirmed conclusions** in separate notes.
 
-**Technology coverage:** Microsoft Entra, Defender XDR, Windows AD, workload identities  
+**Technology coverage:** Microsoft Entra, Defender XDR, Windows AD, workload identities 
 **Trigger:** suspicious authentication, token exposure, credential addition, role change or endpoint credential-access alert.
 
 ## 2. Confirm telemetry prerequisites
@@ -30,7 +28,7 @@ let User = "[email protected]";
 SigninLogs
 | where TimeGenerated > ago(72h) and UserPrincipalName =~ User
 | project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName,
-          ResultType, ConditionalAccessStatus, CorrelationId
+ ResultType, ConditionalAccessStatus, CorrelationId
 | order by TimeGenerated desc
 ```
 
@@ -57,7 +55,7 @@ DeviceProcessEvents
 | where Timestamp > ago(72h)
 | where ProcessCommandLine has_any ("lsass","comsvcs.dll","procdump")
 | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
-          InitiatingProcessFileName, SHA1
+ InitiatingProcessFileName, SHA1
 | order by Timestamp desc
 ```
 

diff --git a/defensive-security/dfir/end-to-end-playbooks/lateral-movement.md b/defensive-security/dfir/end-to-end-playbooks/lateral-movement.md
@@ -1,8 +1,6 @@
 # Lateral Movement: Operational Incident Investigation Playbook
 
-> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready.
-
-**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated.  
+**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. 
 **Review:** 20 October 2026 · **Owner:** SOC/CSIRT · **Authorisation:** Follow local incident command, privacy and evidence procedures.
 
 > **Important:** Queries below are *investigation pivots*, not finished alerts. Microsoft Defender XDR Advanced Hunting and Microsoft Sentinel Log Analytics use different tables and schema. Execute each query only in its stated environment. Preserve evidence, record approvals and do not delay urgent containment when harm is ongoing.
@@ -15,7 +13,7 @@
 4. Preserve relevant logs, incident exports and endpoint artefacts through approved tools. Track collection time, retention gaps and custody.
 5. Keep **observations**, **hypotheses** and **confirmed conclusions** in separate notes.
 
-**Technology coverage:** Defender for Endpoint, Windows Security/System, AD, network and change records  
+**Technology coverage:** Defender for Endpoint, Windows Security/System, AD, network and change records 
 **Trigger:** unexpected remote administrative activity, privileged logon, remote service/task or cross-host execution.
 
 ## 2. Confirm telemetry prerequisites
@@ -29,9 +27,9 @@ Check table availability, licences, audit policy, retention, time synchronisatio
 DeviceProcessEvents
 | where Timestamp > ago(48h)
 | where FileName in~ ("psexec.exe","wmic.exe","winrs.exe","mstsc.exe")
-    or ProcessCommandLine has_any ("Invoke-Command","Enter-PSSession")
+ or ProcessCommandLine has_any ("Invoke-Command","Enter-PSSession")
 | project Timestamp, DeviceName, AccountName, FileName,
-          ProcessCommandLine, InitiatingProcessFileName, ReportId
+ ProcessCommandLine, InitiatingProcessFileName, ReportId
 | order by Timestamp desc
 ```
 
@@ -45,7 +43,7 @@ DeviceLogonEvents
 | where Timestamp > ago(48h)
 | where LogonType in~ ("Network","RemoteInteractive")
 | project Timestamp, DeviceName, AccountName, LogonType,
-          RemoteIP, ActionType, FailureReason
+ RemoteIP, ActionType, FailureReason
 | order by Timestamp desc
 ```
 
@@ -59,7 +57,7 @@ DeviceNetworkEvents
 | where Timestamp > ago(48h)
 | where RemotePort in (135,139,445,3389,5985,5986)
 | project Timestamp, DeviceName, InitiatingProcessFileName,
-          RemoteIP, RemotePort, ActionType
+ RemoteIP, RemotePort, ActionType
 | order by Timestamp desc
 ```
 

diff --git a/defensive-security/dfir/end-to-end-playbooks/phishing-compromise.md b/defensive-security/dfir/end-to-end-playbooks/phishing-compromise.md
@@ -1,8 +1,6 @@
 # Phishing Compromise: Operational Incident Investigation Playbook
 
-> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready.
-
-**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated.  
+**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. 
 **Review:** 20 October 2026 · **Owner:** SOC/CSIRT · **Authorisation:** Follow local incident command, privacy and evidence procedures.
 
 > **Important:** Queries below are *investigation pivots*, not finished alerts. Microsoft Defender XDR Advanced Hunting and Microsoft Sentinel Log Analytics use different tables and schema. Execute each query only in its stated environment. Preserve evidence, record approvals and do not delay urgent containment when harm is ongoing.
@@ -15,7 +13,7 @@
 4. Preserve relevant logs, incident exports and endpoint artefacts through approved tools. Track collection time, retention gaps and custody.
 5. Keep **observations**, **hypotheses** and **confirmed conclusions** in separate notes.
 
-**Technology coverage:** Defender for Office 365, Defender XDR, Entra ID, Exchange Online  
+**Technology coverage:** Defender for Office 365, Defender XDR, Entra ID, Exchange Online 
 **Trigger:** malicious email, user click, credential submission, mailbox change or suspicious endpoint execution.
 
 ## 2. Confirm telemetry prerequisites
@@ -31,7 +29,7 @@ EmailEvents
 | where Timestamp > ago(7d)
 | where RecipientEmailAddress =~ TargetMailbox
 | project Timestamp, NetworkMessageId, RecipientEmailAddress,
-          SenderFromAddress, Subject, DeliveryAction, ThreatTypes
+ SenderFromAddress, Subject, DeliveryAction, ThreatTypes
 | order by Timestamp desc
 ```
 
@@ -58,7 +56,7 @@ DeviceProcessEvents
 | where Timestamp > ago(48h) and DeviceName =~ Host
 | where InitiatingProcessFileName in~ ("winword.exe","excel.exe","outlook.exe","msedge.exe")
 | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
-          InitiatingProcessFileName, InitiatingProcessCommandLine, SHA1
+ InitiatingProcessFileName, InitiatingProcessCommandLine, SHA1
 | order by Timestamp desc
 ```
 

diff --git a/defensive-security/dfir/end-to-end-playbooks/ransomware.md b/defensive-security/dfir/end-to-end-playbooks/ransomware.md
@@ -1,8 +1,6 @@
 # Ransomware: Operational Incident Investigation Playbook
 
-> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready.
-
-**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated.  
+**Operational status:** Practitioner workflow; KQL syntax and outcomes require testing against your deployed product schema. Not production-validated. 
 **Review:** 20 October 2026 · **Owner:** SOC/CSIRT · **Authorisation:** Follow local incident command, privacy and evidence procedures.
 
 > **Important:** Queries below are *investigation pivots*, not finished alerts. Microsoft Defender XDR Advanced Hunting and Microsoft Sentinel Log Analytics use different tables and schema. Execute each query only in its stated environment. Preserve evidence, record approvals and do not delay urgent containment when harm is ongoing.
@@ -15,7 +13,7 @@
 4. Preserve relevant logs, incident exports and endpoint artefacts through approved tools. Track collection time, retention gaps and custody.
 5. Keep **observations**, **hypotheses** and **confirmed conclusions** in separate notes.
 
-**Technology coverage:** Defender for Endpoint, Windows/AD, backup systems, network controls  
+**Technology coverage:** Defender for Endpoint, Windows/AD, backup systems, network controls 
 **Trigger:** mass file modification, ransom note, backup tampering, encryption or extortion claim.
 
 ## 2. Confirm telemetry prerequisites
@@ -30,7 +28,7 @@ DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where ProcessCommandLine has_any ("vssadmin","wbadmin","bcdedit")
 | project Timestamp, DeviceName, AccountName, FileName,
-          ProcessCommandLine, InitiatingProcessFileName, SHA1, ReportId
+ ProcessCommandLine, InitiatingProcessFileName, SHA1, ReportId
 | order by Timestamp desc
 ```
 
@@ -44,8 +42,8 @@ let Host = "REPLACE_WITH_DEVICE_NAME";
 DeviceFileEvents
 | where Timestamp > ago(24h) and DeviceName =~ Host
 | summarize FileEvents=count(), DistinctPaths=dcount(FolderPath),
-          Samples=make_set(FileName, 12)
-    by bin(Timestamp, 15m), InitiatingProcessFileName
+ Samples=make_set(FileName, 12)
+ by bin(Timestamp, 15m), InitiatingProcessFileName
 | order by Timestamp desc
 ```
 
@@ -59,7 +57,7 @@ let Host = "REPLACE_WITH_DEVICE_NAME";
 DeviceNetworkEvents
 | where Timestamp > ago(24h) and DeviceName =~ Host
 | project Timestamp, DeviceName, InitiatingProcessFileName,
-          RemoteIP, RemotePort, RemoteUrl, ActionType
+ RemoteIP, RemotePort, RemoteUrl, ActionType
 | order by Timestamp desc
 ```
 

diff --git a/defensive-security/dfir/field-guides/evidence-acquisition-and-integrity.md b/defensive-security/dfir/field-guides/evidence-acquisition-and-integrity.md
@@ -1,7 +1,5 @@
 # Evidence Acquisition and Integrity
 
-> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready.
-
 **Status:** Procedure template requiring organisational approval and tool-specific validation.
 
 ## Before acquisition

diff --git a/defensive-security/dfir/field-guides/windows-artifact-interpretation.md b/defensive-security/dfir/field-guides/windows-artifact-interpretation.md
@@ -1,7 +1,5 @@
 # Windows Forensic Artefacts: Interpretation Reference
 
-> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready.
-
 **Status:** Technical reference; artefact meaning and location depend on Windows build and configuration.
 
 | Artefact | What it may help establish | Important limitation |

diff --git a/defensive-security/dfir/field-guides/windows-endpoint-triage.md b/defensive-security/dfir/field-guides/windows-endpoint-triage.md
@@ -1,8 +1,6 @@
 # Windows Endpoint Triage: First-Response Field Guide
 
-> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready.
-
-**Reviewed:** 20 October 2026  
+**Reviewed:** 20 October 2026 
 **Status:** Methodology reference; commands must be validated and authorised locally.
 
 ## Initial decisions

diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/dcsync.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/dcsync.md
@@ -11,9 +11,9 @@ DCSync (MITRE ATT&CK T1003.006) abuses Active Directory Directory Replication Se
 - Collect Windows Security Event **4662** from domain controllers and configure the necessary Directory Service Access auditing and directory object SACLs. Event 4662 is not automatically generated for every DCSync attempt.
 - Inspect actual `SecurityEvent` records and their `Properties` and `AccessMask` contents. Schema and event rendering vary by agent and collection method.
 - Relevant replication extended-right GUIDs include:
-  - `1131f6aa-9c07-11d1-f79f-00c04fc2dcd2` — DS-Replication-Get-Changes
-  - `1131f6ad-9c07-11d1-f79f-00c04fc2dcd2` — DS-Replication-Get-Changes-All
-  - `89e95b76-444d-4c62-991a-0facbeda640c` — DS-Replication-Get-Changes-In-Filtered-Set
+  - `1131f6aa-9c07-11d1-f79f-00c04fc2dcd2` ,  DS-Replication-Get-Changes
+  - `1131f6ad-9c07-11d1-f79f-00c04fc2dcd2` ,  DS-Replication-Get-Changes-All
+  - `89e95b76-444d-4c62-991a-0facbeda640c` ,  DS-Replication-Get-Changes-In-Filtered-Set
 
 Event 4662 reports object operations on the domain controller. It does **not** reliably give the network originator's IP address. Neither Event 4672 nor ordinary LDAP connections alone prove DCSync activity.
 

diff --git a/...ion-engineering/threat-detection/ad-detections-and-mitigations/golden-ticket.md b/...ion-engineering/threat-detection/ad-detections-and-mitigations/golden-ticket.md
@@ -1,9 +1,7 @@
 # Golden Ticket: Detection and Response
 
-> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready.
-
-**ATT&CK:** [T1558.001](https://attack.mitre.org/techniques/T1558/001/)  
-**Reviewed:** 20 October 2026  
+**ATT&CK:** [T1558.001](https://attack.mitre.org/techniques/T1558/001/) 
+**Reviewed:** 20 October 2026 
 **Validation:** Concept / unvalidated; verify all fields and behaviour in an authorised lab.
 
 ## Threat overview
@@ -31,13 +29,13 @@ SecurityEvent
 | where TimeGenerated > ago(24h)
 | where EventID == 4769
 | extend Requester = tostring(Account),
-         Service = tostring(ServiceName),
-         SourceAddress = tostring(IpAddress)
+ Service = tostring(ServiceName),
+ SourceAddress = tostring(IpAddress)
 | where isnotempty(Requester)
 | summarize Requests=count(), DistinctServices=dcount(Service),
-            Services=make_set(Service, 30),
-            Sources=make_set(SourceAddress, 20)
-    by Requester, bin(TimeGenerated, 1h)
+ Services=make_set(Service, 30),
+ Sources=make_set(SourceAddress, 20)
+ by Requester, bin(TimeGenerated, 1h)
 | order by DistinctServices desc, Requests desc
 ```
 

diff --git a/...ion-engineering/threat-detection/ad-detections-and-mitigations/kerberoasting.md b/...ion-engineering/threat-detection/ad-detections-and-mitigations/kerberoasting.md
@@ -1,9 +1,7 @@
 # Kerberoasting: Detection and Investigation
 
-> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready.
-
-**ATT&CK:** [T1558.003](https://attack.mitre.org/techniques/T1558/003/)  
-**Review date:** 20 October 2026  
+**ATT&CK:** [T1558.003](https://attack.mitre.org/techniques/T1558/003/) 
+**Review date:** 20 October 2026 
 **Validation:** Concept / unvalidated; domain-controller telemetry must be confirmed.
 
 ## Threat overview
@@ -28,13 +26,13 @@ SecurityEvent
 | where TimeGenerated > ago(24h)
 | where EventID == 4769
 | extend RequestingAccount = tostring(Account),
-         ClientAddress = tostring(IpAddress),
-         TargetService = tostring(ServiceName)
+ ClientAddress = tostring(IpAddress),
+ TargetService = tostring(ServiceName)
 | where isnotempty(RequestingAccount) and isnotempty(TargetService)
 | summarize Requests=count(),
-            Services=dcount(TargetService),
-            TargetServices=make_set(TargetService, 30)
-    by RequestingAccount, ClientAddress, WindowStart=bin(TimeGenerated, 15m)
+ Services=dcount(TargetService),
+ TargetServices=make_set(TargetService, 30)
+ by RequestingAccount, ClientAddress, WindowStart=bin(TimeGenerated, 15m)
 | where Services >= 5
 | order by Services desc, Requests desc
 ```

diff --git a/...engineering/threat-detection/ad-detections-and-mitigations/password-spraying.md b/...engineering/threat-detection/ad-detections-and-mitigations/password-spraying.md
@@ -1,7 +1,5 @@
 # Password Spraying: Detection and Investigation
 
-> **RootGuard technical reference** · **Environment:** Verify product, platform and telemetry prerequisites · **Validation:** Refer to the status below; examples are not automatically production-ready.
-
 **ATT&CK:** [T1110.003](https://attack.mitre.org/techniques/T1110/003/)  
 **Review date:** 20 October 2026  
 **Validation:** Concept / unvalidated; verify with your environment's telemetry.

diff --git a/...ion-engineering/threat-detection/ad-detections-and-mitigations/silver-ticket.md b/...ion-engineering/threat-detection/ad-detections-and-mitigations/silver-ticket.md
@@ -1,7 +1,7 @@
 # Silver Ticket: Detection and Response
 
-**ATT&CK:** [T1558.002](https://attack.mitre.org/techniques/T1558/002/)  
-**Reviewed:** 20 October 2026  
+**ATT&CK:** [T1558.002](https://attack.mitre.org/techniques/T1558/002/) 
+**Reviewed:** 20 October 2026 
 **Validation:** Concept / unvalidated; verify on representative services.
 
 ## Threat overview
@@ -30,10 +30,10 @@ SecurityEvent
 | where EventID == 4624
 | where AuthenticationPackageName =~ "Kerberos"
 | extend AccountName = tostring(Account),
-         SourceAddress = tostring(IpAddress)
+ SourceAddress = tostring(IpAddress)
 | summarize Logons=count(), Accounts=make_set(AccountName, 30),
-            Sources=make_set(SourceAddress, 20)
-    by Computer, LogonType, bin(TimeGenerated, 1h)
+ Sources=make_set(SourceAddress, 20)
+ by Computer, LogonType, bin(TimeGenerated, 1h)
 | order by Logons desc
 ```