Executive leadership
Everything I've written on executive leadership, with the research pieces first. Each one ends with something you can do on Monday.
Dealing with one of these problems yourself? I work with organizations that need answers, not another slide deck. Let's talk.
What's in a five-angle short
Most subjects here are one page with five short sections, always in this order. Each has its own colour inside the article so you can jump to the one you need.
- 1Where I'd start: the first move I'd make, and the question I'd ask before spending anything.
- 2Where plans fail: where plans on this subject usually break, and the assumption I'd test first.
- 3Beyond the jargon: what the subject actually means once the vendor language is stripped out.
- 4What good looks like: the result that would tell you it worked, and the number I'd watch.
- 5The call leaders can't dodge: the decision leadership has to own, and what it needs on the table to make it.
-
How Can a Board Verify That Cyber Risk Is Improving?
Challenge cybersecurity risk trends with comparable measures, tested controls, explicit uncertainty and independent assurance tied to business consequences.
-
Should You Buy a New Security Tool or Improve the Controls You Have?
Compare security investments using operational evidence, full costs, implementation delays and uncertainty. Test when a new tool beats improving existing controls.
-
Your Board Needs a Decision, Not Another Security Dashboard
What I look at in cybersecurity board reporting, the decisions it forces, and what credible evidence looks like before you spend.
-
A new security leader's first ninety days
The temptation is to arrive with a plan. The better move is to arrive with questions and leave with a plan the organisation recognises as its own.
-
A supplier got hit by ransomware. What do we do?
Cut their access to you first, then find out what of yours they held, then decide what you owe your own customers and regulators. The order, and the questions to put to the supplier.
-
Board advisory
I would not begin board advisory by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
-
Can executives and directors be held personally liable for a data breach?
Rarely for the breach itself. Readily for what happens after: concealment, false statements, and oversight that didn't exist. What the Uber and SolarWinds cases actually established.
-
Executive education
I would not begin executive education by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
Fractional CISO engagement
I would not begin fractional CISO engagement by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and...
-
Full-Time CISO or Fractional CISO: How Do You Decide?
Choose security leadership by decision authority, response coverage, execution capacity and independence. Compare fractional and full-time models before cost.
-
How to say no to the business without being overruled
Security leaders who say no a lot get routed around. Security leaders who never say no get blamed later. The way through isn't a better no; it's a better offer.
-
Incident leadership
I would not begin incident leadership by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
Is our cybersecurity budget enough? How to tell without a benchmark
Percent-of-IT benchmarks tell you what others spend, not what you need. Judge the budget by whether it closes your top risks, and whether you can prove it.
-
Keynote planning
I would not begin keynote planning by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Leading cross-functional teams
I would not begin leading cross-functional teams by buying another platform or launching a large programme. I would find the boundary, the accountable owner,...
-
Security culture
I would not begin security culture by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Security leadership hiring
I would not begin security leadership hiring by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and...
-
Security leadership transition
I would not begin security leadership transition by buying another platform or launching a large programme. I would find the boundary, the accountable owner,...
-
Should the CISO report to the CIO or the CEO?
The reporting line matters less than three things: an unfiltered path to the board, authority to stop work, and a budget the CIO can't quietly reallocate. How to get them under either structure.
-
Technical workshop design
I would not begin technical workshop design by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and ...
-
The CISO just resigned. What do we do in the next 30 days?
Name an interim owner today, secure the credentials and the relationships, keep the regulatory designations valid, and don't rush the hire. The 30-day plan.
-
What a Cybersecurity Board Report Should Actually Answer
A board doesn't need a guided tour of the security dashboard. It needs to know what could go wrong, how badly the organization could be hurt, whether the def...
-
What should a new CISO deliver in the first 90 days?
An honest picture of where the organisation stands, the three risks that matter most, a plan with dates, and a working incident process. Not a new tool. What to expect, and how to judge it.
-
What should the board ask the CISO? Seven questions that get real answers
Skip 'are we secure?' Ask what would hurt us most, how we'd know, who decides, what we've tested, and what you need from us. Seven questions and the answers to expect.
-
Who can accept a cyber risk on behalf of the company?
The executive who owns the business outcome the risk threatens, within limits the board has set, in writing, with an expiry date. Not the security team, and not whoever wants the project to ship.
-
Will our cyber insurance actually pay? What to check before renewal
It pays if the controls you attested to were running, you notified on time, you used approved vendors, and the loss isn't excluded. Five things to check before you renew.
Nothing matches. Try another word, or ask me directly.