Cybersecurity Priorities for 2024: A Practitioner's View
Annual planning works best when priorities are tied to execution realities. Here are the cybersecurity bets that should matter most in 2024.
December 2023
November 2023
Ransomware Negotiation Readiness: Before You Need It
Most organizations think about negotiation only after encryption starts. The right time to plan is before the first extortion note appears.
Detection & Response6 min
October 2023
NIST CSF 2.0: What Security Leaders Should Do Now
NIST CSF 2.0 is close, and the shift toward governance and broader applicability has practical implications for every security program.
Governance & Risk6 min
September 2023
Cloud Permission Sprawl and How to Fix It
Cloud IAM debt accumulates quietly until attackers exploit it. Here is a practical model for reducing permission sprawl safely.
August 2023
Board Cyber Reporting: Metrics That Drive Decisions
Boards do not need more dashboard noise. They need metrics tied to business decisions, material risk, and response readiness.
July 2023
Software Supply Chain Security After SLSA and SBOM
SBOMs and provenance frameworks are useful, but only when teams connect them to real build controls and response workflows.
June 2023
Attack Surface Management: From Periodic Scans to Continuous Visibility
Periodic vulnerability scans miss the assets attackers find first. Continuous attack surface management closes that gap.
May 2023
Generative AI Risk: A Governance Framework for Security Leaders
Generative AI adoption is outpacing governance. Security leaders need a practical framework before shadow AI becomes the next shadow IT.
April 2023
Platform Engineering and Security: Building Golden Paths
Platform engineering gives security teams a new lever: embed controls into the paths developers already want to use.
DevSecOps7 min
The Calculus Crossroads of Policy Pyramid
Derivatives and integrals offer a surprisingly practical lens on the Policy Pyramid, connecting high-level intent to the controls that implement it.
March 2023
Factorial Separation of Duties for Modern AppSec Compliance
Breaking high-risk activities into smaller, verifiable components lets teams build roads instead of climbing mountains — and makes AppSec compliance continuous rather than ceremonial.
SEC Cyber Disclosure Rules: What CISOs Should Prepare for Now
The SEC’s proposed cyber disclosure rules signal a major shift in how public companies must govern incident reporting, risk oversight, and executive accountability.
February 2023
Identity Threat Detection and Response (ITDR): What You Need to Know
ITDR has moved from emerging category to operational necessity as attackers increasingly target identity systems, session tokens, and MFA weaknesses.
January 2023
AI in Cybersecurity: Separating Hype from Value
Generative AI is everywhere in security conversations, but value only comes when teams tie AI use cases to measurable outcomes and operational reality.