Environment Separation Is a Claim Until Someone Reads the Config
A production service that answered every check was reading development tables and publishing an index with no version history in it at all.
Governance & Risk
Programme governance, risk ownership, compliance regimes, and the operating cadences that keep them honest.
52 articles
What Dies First When You Retire a Service
Retiring a service is an ordered operation with a preservation gate that has to be verified before anything is destroyed, and a list of consumers that no inventory holds.
What Leaks Through the Pipe That Publishes
A private-to-public sync excluded every file it was supposed to exclude and still published the committer's identity, the commit bodies, and a sentence naming the directory it had just hidden.
Retrieved Text Is Part of the Prompt
There is no parser inside a language model that separates the instructions you wrote from the document it just retrieved. Every control that assumes there is one fails in the same direction.
Fail Closed on the Server, Fail Open at the Client
Two commits a day apart set opposite failure defaults in the same backend, and what decided each one was not the sensitivity of the asset but who gets refused when the control is wrong.
Most Audit Findings Are Drift, Not Missing Controls
Nine findings came out of one adversarial audit. Two were exploitable defects and five were divergence between what the documentation claimed and what the code did.
Shipping a Control That Can Lock Out Your Own Users
Device attestation is a control where a correct implementation and a botched rollout produce the same 403, so the rollout mechanics matter more than the cryptography.
Freeze, Destroy, and the Grants You Give Back
Two AWS systems went dark seventeen days apart. Deciding how to stop them took more security work than building them did, and the artifacts I preserved were deleted eighteen days later by someone doing a legitimate job.
The Finding Count Fell and the Severity Did Not
Five review passes over one backend in seven days. The finding count fell every time, the top severity band did not move until the last pass, and two of those top findings were defects the pass before had introduced.
Least Privilege for Non-Human Developers
An agent's permissions are whatever its tools can reach, not whatever its role description says, so the policy has to be written at the tool boundary and tested like a control.
What Automating a Zero Trust Assessment Taught Me About Maturity Scores
Writing a maturity score down as a function forces you to answer the scoring questions a consultant never has to say out loud, starting with what an unanswered question is worth.
How CI Security Gates Quietly Turn Themselves Off
A pipeline reporting green while its security tests never execute looks identical to one that passed, and nothing in the default tooling tells you which you have.
Cloud Security Assurance: Proving Controls in Real Time
Control claims are cheap. Assurance improves when teams can produce timely evidence that controls are operating as designed.
Cyber Risk Ownership Models for Distributed Organizations
Distributed organizations need explicit cyber risk ownership or they default to confusion and delay.
Securing Business Process Automation Without Killing Speed
Automation accelerates execution and mistakes. Security guardrails must be designed into workflows without becoming bottlenecks.
How to Run Security Architecture Reviews That Change Outcomes
Architecture reviews should reduce downstream risk, not become documentation theatre.
Measuring Cybersecurity Effectiveness Without Vanity Metrics
Effective security metrics should change decisions, not just decorate dashboards.
AppSec Governance in Platform-First Organizations
As platform teams own more delivery pathways, AppSec governance has to shift from ticketing to policy-driven enablement.
CISO Planning Checklist for 2025
Planning for the next year should translate risk into prioritized execution. This checklist helps security leaders focus on what actually moves outcomes.
Securing AI-Enabled Workflows with Practical Guardrails
AI-enabled workflows are now embedded in daily operations. Security teams need practical guardrails that protect data without blocking productivity.
Cybersecurity Program Maturity Models: Where Teams Get Stuck
Maturity models help when they guide decisions. They hurt when they become scorekeeping detached from execution reality.
Security Architecture Decision Records That Scale
Architecture quality improves when decisions are recorded with context, tradeoffs, and accountable ownership.
Executive Cyber Communication: What Boards Actually Need
Board confidence improves when communication is clear on risk, decisions, and tradeoffs—not when metrics are louder.
Multi-Cloud Security: Accountability Models That Work
Most multi-cloud security failures are operating-model failures. Clear accountability beats bigger tooling budgets.
Security Architecture in an AI-Accelerated World
As AI capabilities accelerate, security architecture has to evolve from static reviews to faster, risk-informed design guardrails.
Cybersecurity Priorities for 2024: A Practitioner's View
Annual planning works best when priorities are tied to execution realities. Here are the cybersecurity bets that should matter most in 2024.
NIST CSF 2.0: What Security Leaders Should Do Now
NIST CSF 2.0 is close, and the shift toward governance and broader applicability has practical implications for every security program.
Governance & Risk6 min
Board Cyber Reporting: Metrics That Drive Decisions
Boards do not need more dashboard noise. They need metrics tied to business decisions, material risk, and response readiness.
Generative AI Risk: A Governance Framework for Security Leaders
Generative AI adoption is outpacing governance. Security leaders need a practical framework before shadow AI becomes the next shadow IT.
The Calculus Crossroads of Policy Pyramid
Derivatives and integrals offer a surprisingly practical lens on the Policy Pyramid, connecting high-level intent to the controls that implement it.
Factorial Separation of Duties for Modern AppSec Compliance
Breaking high-risk activities into smaller, verifiable components lets teams build roads instead of climbing mountains — and makes AppSec compliance continuous rather than ceremonial.
SEC Cyber Disclosure Rules: What CISOs Should Prepare for Now
The SEC’s proposed cyber disclosure rules signal a major shift in how public companies must govern incident reporting, risk oversight, and executive accountability.
AI in Cybersecurity: Separating Hype from Value
Generative AI is everywhere in security conversations, but value only comes when teams tie AI use cases to measurable outcomes and operational reality.
2022 Security Retrospective: Trends That Will Shape 2023
From supply-chain risk to cloud governance and resilience, 2022 exposed which security programs adapted and which ones stalled.
The CISO's Dilemma: Innovation vs. Risk
Security leaders are expected to accelerate innovation and reduce risk at the same time. Here's how to navigate that tension without stalling the business.
Security Metrics That Matter: What to Report to the Board
Boards don't need more security data. They need decision-grade metrics that connect controls, risk movement, and business impact.
Cloud Security Posture Management: Getting It Right
CSPM tools can improve visibility fast, but programs fail when teams mistake alerts for outcomes. Here's how to operationalize CSPM the right way.
Third-Party Risk Management in the Age of Supply Chain Attacks
Third-party risk programs fail when questionnaires replace continuous validation. Here's how to operationalize risk management in today's supply-chain threat environment.
The DevSecOps Maturity Model: Where Does Your Org Stand?
DevSecOps maturity isn't about tooling volume. It's about how consistently security controls produce better outcomes at delivery speed.
Zero Trust for Healthcare: Balancing Security and Care
Healthcare security decisions affect patient care in real time. A workable Zero Trust model must protect systems without disrupting clinical operations.
Cloud Security Automation: From Manual to Machine-Speed
Cloud scale breaks manual security operations. The path forward is automation tied to policy and measurable control outcomes.
Software Bill of Materials: Your New Security Requirement
SBOMs are moving from optional artifact to expected control. Here's how to make them operationally useful instead of performative.
Board-Level Security Communication: Speaking Business, Not Tech
Security leaders gain influence when they communicate risk in business terms, decision options, and measurable outcomes.
PCI DSS Compliance: Lessons from the Trenches
PCI DSS programs fail when teams treat assessment prep as the objective. Here's how to build evidence-driven compliance that strengthens security.
Governance & Risk6 min
Security Architecture Reviews: A Consultant's Playbook
Security architecture reviews should drive decisions, not generate shelfware. Here's a practical playbook that works in enterprise environments.
OWASP Top 10 in Practice: What Actually Matters
The OWASP Top 10 is useful, but only if teams translate it into real engineering decisions and risk priorities.
Application Security Program Management: Beyond the Tools
AppSec maturity is less about tool count and more about operating model discipline, ownership, and measurable outcomes.
Securing 30,000 Locations: IoT Security at Scale
IoT security doesn't fail because of devices alone. It fails when architecture, ownership, and operational controls don't scale with deployment speed.
Why Every CISO Needs a Cryptographic Inventory
You can't migrate what you can't see. A cryptographic inventory is the foundation for resilience, compliance, and future post-quantum readiness.
Software Supply Chain Security: A Framework for 2021
After SolarWinds, software supply chain security moved from niche concern to board-level priority. Here's a practical framework for 2021.
SolarWinds and the Software Supply Chain Wake-Up Call
SolarWinds exposed a hard truth: trusted software channels can become attack channels. Here's what security leaders should do next.
Compliance Doesn't Equal Security (But You Still Need Both)
Passing an audit is not the same as reducing risk. Here's how to build a program where compliance supports security instead of replacing it.
Governance & Risk6 min