The Compliance Trap: How Regulation Shapes Security (for Better and Worse)
Regulation sets the floor for security, and a restaurant kitchen shows how easily we mistake that floor for the finish line.
Writing & perspectives
Beyond the
checklist.
Ideas from a career in security. Questions worth asking. A practical perspective on risk, leadership, and trust.
17 articles
Is Your Risk Actually Going Down? Here's How to Grade It.
A practical look at measuring the direction of risk, beyond the colors in a risk register.
✨ From the Age of Unreason to the Age of Synthesis
A reflection on long-term thinking, resilient institutions, and building for the people who come after us.
The Illusion of Security—Why Passing an Audit Doesn't Mean You're Safe
Why audit assurance and operational security need to be understood together.
Hanlon’s Razor in Cybersecurity: A Smart or Risky Approach for a CISO?
A human perspective on security mistakes, intent, and the assumptions behind our response.
Want a masterclass in incident response? Watch Supervolcano (BBC, 2005)
A film-based perspective on crisis coordination and incident response.
Beyond the Checklist: Rethinking Cybersecurity for a Pragmatic Approach
An introduction to a pragmatic approach that looks beyond compliance checklists.
The Corporate Awards Industry: A Game of Vanity, Not Merit
A candid examination of industry recognition and the incentives behind corporate awards.
Did You Know? The First "Denial of Service Attack" Wasn't Digital
A historical analogy connecting resistance to technological change with modern security language.
Best Practices Considerations for Managing a CISO Transition
Considerations for continuity and responsibility when a security leader leaves an organization.
SPAM!!!
Lessons from inbox cleanup, spam filtering, and the challenge of receiving important email.
The SSO Tax: Why It's Time to Demand Built-In Single Sign-On Support
A case for making single sign-on a built-in security capability rather than a premium add-on.
🔍 Heilmeier's Catechism: A Guiding Light for Cybersecurity Initiatives 🔍
Questions that help security leaders explain an initiative’s purpose, feasibility, and impact without jargon.
Introducing CII: Safeguarding Company Identifiable Information
An argument for extending information protection beyond personal data to sensitive company information.
Beware the LinkedIn Scams
A walkthrough of suspicious connection requests and the warning signs in fraudulent profiles.
Diversity isn't Diversity when it is. Diversity is Diversity when it isn't.
A perspective on diversity and the assumptions behind how we recognize it.
Information Security Practitioners: Stop Enabling, Start Facilitating!
How the language security practitioners use can shape their partnership with the business.
No articles match your search. Try “risk” or “leadership”.