SolarWinds and the Software Supply Chain Wake-Up Call
SolarWinds exposed a hard truth: trusted software channels can become attack channels. Here's what security leaders should do next.
December 2020
November 2020
Incident Response Planning: What I Learned from Real Breaches
Most incident response plans look good on paper and fail under pressure. Here are the lessons that hold up in real breach scenarios.
Detection & Response6 min
October 2020
The Hidden Risks in Your CI/CD Pipeline
Fast pipelines can quietly become high-risk pipelines. Here are the security gaps I see most often — and how to close them without slowing delivery.
September 2020
Cloud Security Architecture: Lessons from 50+ Migrations
Cloud migration doesn't fail because of technology. It fails because architecture and security decisions are made in the wrong order.
August 2020
Threat Modeling for Non-Security Teams: A Practical Guide
Threat modeling isn't just for security specialists. Here's a practical framework product and engineering teams can use without slowing delivery.
July 2020
Compliance Doesn't Equal Security (But You Still Need Both)
Passing an audit is not the same as reducing risk. Here's how to build a program where compliance supports security instead of replacing it.
Governance & Risk6 min
June 2020
DevSecOps Is Not Just Shifting Left — It's Shifting Everywhere
'Shift left' was a good start, but it's no longer enough. Modern DevSecOps demands security controls across the entire software factory.
May 2020
Identity Is the New Perimeter: IAM in a Post-COVID World
Remote work made one thing clear: perimeter controls are no longer enough. Identity has become the control plane for enterprise security.
April 2020
Building a Zero Trust Roadmap That Actually Works
Most Zero Trust programs fail because they start with tools instead of outcomes. Here's a practical roadmap that works in real enterprises.
March 2020
Remote Work Security: What Enterprises Get Wrong
The shift to remote work exposed security gaps most enterprises didn't know they had. Here are the mistakes I'm seeing — and how to fix them fast.
February 2020
The Real Cost of Ignoring Software Composition Analysis
Most enterprises don't know what's inside the software they ship. Software Composition Analysis isn't optional anymore — here's what ignoring it actually costs.
January 2020
Why Your Firewall Strategy Needs a Rethink in 2020
The traditional firewall-centric security model is showing its age. Here's what enterprise security architects should be rethinking heading into 2020.