Dr. Lin Clark: Articleshttps://drlinclark.com/articles/Shorts and research on cybersecurity and AI, by Dr. Lin Clark.enWhy Useful AI Can Be Harder to Governhttps://drlinclark.com/articles/ai-security/boxing-einstein-useful-answer-governance/https://drlinclark.com/articles/ai-security/boxing-einstein-useful-answer-governance/Thu, 29 Oct 2026 16:30:52 +0000AI securityWhy a useful AI answer still needs evidence before wider use: distinguish observed benefits, hidden consequences and the cost of waiting.When Does an AI Warning Become a Working Control?https://drlinclark.com/articles/ai-security/boxing-einstein-warning-into-working-control/https://drlinclark.com/articles/ai-security/boxing-einstein-warning-into-working-control/Thu, 29 Oct 2026 16:30:52 +0000AI securityTurn AI risk warnings into owned, funded and testable controls. A short from Boxing Einstein on the gap between recognizing a problem and changing it.Can You Control AI Without Understanding Every Answer?https://drlinclark.com/articles/ai-security/boxing-einstein-control-without-complete-understanding/https://drlinclark.com/articles/ai-security/boxing-einstein-control-without-complete-understanding/Thu, 29 Oct 2026 16:30:52 +0000AI securityLearn how AI control can focus on authority, evidence and consequences without requiring complete understanding of every internal computation.The Security Dashboard Nobody Can Usehttps://drlinclark.com/articles/security-operations/the-security-dashboard-nobody-can-use/https://drlinclark.com/articles/security-operations/the-security-dashboard-nobody-can-use/Thu, 29 Oct 2026 15:55:22 +0000Security operationsA dashboard can be full of healthy percentages and still leave leadership unable to say whether the organization is safer.Purple teaminghttps://drlinclark.com/articles/security-operations/purple-teaming/https://drlinclark.com/articles/security-operations/purple-teaming/Thu, 29 Oct 2026 15:55:22 +0000Security operationsI would not begin purple teaming by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...Threat huntinghttps://drlinclark.com/articles/security-operations/threat-hunting/https://drlinclark.com/articles/security-operations/threat-hunting/Thu, 29 Oct 2026 15:55:22 +0000Security operationsI would not begin threat hunting by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...Continuous Monitoring Is Not Continuous Assurance — field noteshttps://drlinclark.com/articles/security-operations/continuous-monitoring-assurance-field-notes/https://drlinclark.com/articles/security-operations/continuous-monitoring-assurance-field-notes/Thu, 29 Oct 2026 15:55:22 +0000Security operationsA dashboard can show a hundred green indicators and still tell me very little about whether an attacker can reach a critical system. Monitoring collects obse...SOC operating modelhttps://drlinclark.com/articles/security-operations/soc-operating-model/https://drlinclark.com/articles/security-operations/soc-operating-model/Thu, 29 Oct 2026 15:55:22 +0000Security operationsI would not begin SOC operating model by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...Detection engineeringhttps://drlinclark.com/articles/security-operations/detection-engineering/https://drlinclark.com/articles/security-operations/detection-engineering/Thu, 29 Oct 2026 15:55:22 +0000Security operationsI would not begin detection engineering by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...SOC staffinghttps://drlinclark.com/articles/security-operations/soc-staffing/https://drlinclark.com/articles/security-operations/soc-staffing/Thu, 29 Oct 2026 15:55:22 +0000Security operationsI would not begin SOC staffing by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario ...Telemetry strategyhttps://drlinclark.com/articles/security-operations/telemetry-strategy/https://drlinclark.com/articles/security-operations/telemetry-strategy/Thu, 29 Oct 2026 15:55:22 +0000Security operationsI would not begin telemetry strategy by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...Alert fatiguehttps://drlinclark.com/articles/security-operations/alert-fatigue/https://drlinclark.com/articles/security-operations/alert-fatigue/Thu, 29 Oct 2026 15:55:22 +0000Security operationsI would not begin alert fatigue by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario...SOC performance metricshttps://drlinclark.com/articles/security-operations/soc-performance-metrics/https://drlinclark.com/articles/security-operations/soc-performance-metrics/Thu, 29 Oct 2026 15:55:22 +0000Security operationsI would not begin SOC performance metrics by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...When to retire a detection rulehttps://drlinclark.com/articles/security-operations/retire-a-detection/https://drlinclark.com/articles/security-operations/retire-a-detection/Thu, 29 Oct 2026 15:55:22 +0000Security operationsEvery SOC I've looked at has rules nobody remembers writing. They fire, an analyst closes them, and the cycle repeats until someone finally asks what the rul...SIEM architecturehttps://drlinclark.com/articles/security-operations/siem-architecture/https://drlinclark.com/articles/security-operations/siem-architecture/Thu, 29 Oct 2026 15:55:22 +0000Security operationsI would not begin SIEM architecture by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...SOAR automationhttps://drlinclark.com/articles/security-operations/soar-automation/https://drlinclark.com/articles/security-operations/soar-automation/Thu, 29 Oct 2026 15:55:22 +0000Security operationsI would not begin SOAR automation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenar...Why Your SOC Is Busy but Not Effective — field noteshttps://drlinclark.com/articles/security-operations/soc-effectiveness-field-notes/https://drlinclark.com/articles/security-operations/soc-effectiveness-field-notes/Thu, 29 Oct 2026 15:55:22 +0000Security operationsA security operations center can be busy around the clock and still miss the incident that matters. I don't find the number of alerts closed particularly rea...Nine questions before you sign a managed SOC contracthttps://drlinclark.com/articles/security-operations/managed-soc-contract-questions/https://drlinclark.com/articles/security-operations/managed-soc-contract-questions/Thu, 29 Oct 2026 15:55:22 +0000Security operationsOutsourcing detection can be the right call. Outsourcing accountability can't be. The contract is where those two get confused, so these are the questions I'...Security testinghttps://drlinclark.com/articles/application-security/security-testing/https://drlinclark.com/articles/application-security/security-testing/Thu, 29 Oct 2026 15:55:22 +0000Application securityI would not begin security testing by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...Release engineeringhttps://drlinclark.com/articles/application-security/release-engineering/https://drlinclark.com/articles/application-security/release-engineering/Thu, 29 Oct 2026 15:55:22 +0000Application securityI would not begin release engineering by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...Secrets in repositorieshttps://drlinclark.com/articles/application-security/secrets-in-repositories/https://drlinclark.com/articles/application-security/secrets-in-repositories/Thu, 29 Oct 2026 15:55:22 +0000Application securityI would not begin secrets in repositories by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...API authorizationhttps://drlinclark.com/articles/application-security/api-authorization/https://drlinclark.com/articles/application-security/api-authorization/Thu, 29 Oct 2026 15:55:22 +0000Application securityI would not begin API authorization by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...Code reviewhttps://drlinclark.com/articles/application-security/code-review/https://drlinclark.com/articles/application-security/code-review/Thu, 29 Oct 2026 15:55:22 +0000Application securityI would not begin code review by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario w...Secure SDLChttps://drlinclark.com/articles/application-security/secure-sdlc/https://drlinclark.com/articles/application-security/secure-sdlc/Thu, 29 Oct 2026 15:55:22 +0000Application securityI would not begin secure SDLC by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario w...Authentication designhttps://drlinclark.com/articles/application-security/authentication-design/https://drlinclark.com/articles/application-security/authentication-design/Thu, 29 Oct 2026 15:55:22 +0000Application securityI would not begin authentication design by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...Threat modelinghttps://drlinclark.com/articles/application-security/threat-modeling/https://drlinclark.com/articles/application-security/threat-modeling/Thu, 29 Oct 2026 15:55:22 +0000Application securityI would not begin threat modeling by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenar...Dependency vulnerabilitieshttps://drlinclark.com/articles/application-security/dependency-vulnerabilities/https://drlinclark.com/articles/application-security/dependency-vulnerabilities/Thu, 29 Oct 2026 15:55:22 +0000Application securityI would not begin dependency vulnerabilities by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and...Software supply chainhttps://drlinclark.com/articles/application-security/software-supply-chain/https://drlinclark.com/articles/application-security/software-supply-chain/Thu, 29 Oct 2026 15:55:22 +0000Application securityI would not begin software supply chain by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...Remote access securityhttps://drlinclark.com/articles/network-security/remote-access-security/https://drlinclark.com/articles/network-security/remote-access-security/Thu, 29 Oct 2026 15:55:22 +0000Network securityI would not begin remote access security by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one...Network segmentationhttps://drlinclark.com/articles/network-security/network-segmentation/https://drlinclark.com/articles/network-security/network-segmentation/Thu, 29 Oct 2026 15:55:22 +0000Network securityI would not begin network segmentation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...Wireless securityhttps://drlinclark.com/articles/network-security/wireless-security/https://drlinclark.com/articles/network-security/wireless-security/Thu, 29 Oct 2026 15:55:22 +0000Network securityI would not begin wireless security by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...Network incident responsehttps://drlinclark.com/articles/network-security/network-incident-response/https://drlinclark.com/articles/network-security/network-incident-response/Thu, 29 Oct 2026 15:55:22 +0000Network securityI would not begin network incident response by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and ...Firewall rule governancehttps://drlinclark.com/articles/network-security/firewall-rule-governance/https://drlinclark.com/articles/network-security/firewall-rule-governance/Thu, 29 Oct 2026 15:55:22 +0000Network securityI would not begin firewall rule governance by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and o...DDoS resiliencehttps://drlinclark.com/articles/network-security/ddos-resilience/https://drlinclark.com/articles/network-security/ddos-resilience/Thu, 29 Oct 2026 15:55:22 +0000Network securityI would not begin DDoS resilience by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenar...Routing trusthttps://drlinclark.com/articles/network-security/routing-trust/https://drlinclark.com/articles/network-security/routing-trust/Thu, 29 Oct 2026 15:55:22 +0000Network securityI would not begin routing trust by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario...Your network is flat. Here's what that costs youhttps://drlinclark.com/articles/network-security/flat-network/https://drlinclark.com/articles/network-security/flat-network/Thu, 29 Oct 2026 15:55:22 +0000Network securityFlat networks are the default because they're easy. Everything can talk to everything, nothing breaks, and the diagram fits on one page. The cost shows up on...DNS securityhttps://drlinclark.com/articles/network-security/dns-security/https://drlinclark.com/articles/network-security/dns-security/Thu, 29 Oct 2026 15:55:22 +0000Network securityI would not begin DNS security by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario ...Network telemetryhttps://drlinclark.com/articles/network-security/network-telemetry/https://drlinclark.com/articles/network-security/network-telemetry/Thu, 29 Oct 2026 15:55:22 +0000Network securityI would not begin network telemetry by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...Secure network architecturehttps://drlinclark.com/articles/network-security/secure-network-architecture/https://drlinclark.com/articles/network-security/secure-network-architecture/Thu, 29 Oct 2026 15:55:22 +0000Network securityI would not begin secure network architecture by buying another platform or launching a large programme. I would find the boundary, the accountable owner, an...Cyber range developmenthttps://drlinclark.com/articles/education-programs/cyber-range-development/https://drlinclark.com/articles/education-programs/cyber-range-development/Thu, 29 Oct 2026 15:55:22 +0000Education and trainingI would not begin cyber range development by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...Skills gap analysishttps://drlinclark.com/articles/education-programs/skills-gap-analysis/https://drlinclark.com/articles/education-programs/skills-gap-analysis/Thu, 29 Oct 2026 15:55:22 +0000Education and trainingI would not begin skills gap analysis by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...Competency assessmenthttps://drlinclark.com/articles/education-programs/competency-assessment/https://drlinclark.com/articles/education-programs/competency-assessment/Thu, 29 Oct 2026 15:55:22 +0000Education and trainingI would not begin competency assessment by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...Workforce developmenthttps://drlinclark.com/articles/education-programs/workforce-development/https://drlinclark.com/articles/education-programs/workforce-development/Thu, 29 Oct 2026 15:55:22 +0000Education and trainingI would not begin workforce development by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...Training measurementhttps://drlinclark.com/articles/education-programs/training-measurement/https://drlinclark.com/articles/education-programs/training-measurement/Thu, 29 Oct 2026 15:55:22 +0000Education and trainingI would not begin training measurement by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...Cybersecurity Hiring Starts With the Work, Not the Job Title — field noteshttps://drlinclark.com/articles/education-programs/cybersecurity-workforce-tasks-field-notes/https://drlinclark.com/articles/education-programs/cybersecurity-workforce-tasks-field-notes/Thu, 29 Oct 2026 15:55:22 +0000Education and trainingAsk five employers what a security engineer does and you'll get five different answers. One writes detections, another reviews cloud architecture, a third ad...Stop Measuring Cybersecurity Training by Who Clicked Complete — field noteshttps://drlinclark.com/articles/education-programs/cybersecurity-training-program-development-field-notes/https://drlinclark.com/articles/education-programs/cybersecurity-training-program-development-field-notes/Thu, 29 Oct 2026 15:55:22 +0000Education and trainingA hundred percent training completion rate is an administrative achievement. It tells me people opened a course, clicked through it, and satisfied a requirem...Cyber curriculum designhttps://drlinclark.com/articles/education-programs/cyber-curriculum-design/https://drlinclark.com/articles/education-programs/cyber-curriculum-design/Thu, 29 Oct 2026 15:55:22 +0000Education and trainingI would not begin cyber curriculum design by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...Incident response exerciseshttps://drlinclark.com/articles/education-programs/incident-response-exercises/https://drlinclark.com/articles/education-programs/incident-response-exercises/Thu, 29 Oct 2026 15:55:22 +0000Education and trainingI would not begin incident response exercises by buying another platform or launching a large programme. I would find the boundary, the accountable owner, an...Executive cyber workshopshttps://drlinclark.com/articles/education-programs/executive-cyber-workshops/https://drlinclark.com/articles/education-programs/executive-cyber-workshops/Thu, 29 Oct 2026 15:55:22 +0000Education and trainingI would not begin executive cyber workshops by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and ...A Cybersecurity Course Is Not a Learning Programhttps://drlinclark.com/articles/education-programs/a-cybersecurity-course-is-not-a-learning-program/https://drlinclark.com/articles/education-programs/a-cybersecurity-course-is-not-a-learning-program/Thu, 29 Oct 2026 15:55:22 +0000Education and trainingA full training calendar proves that classes happened.A tabletop exercise executives will actually rememberhttps://drlinclark.com/articles/education-programs/tabletop-that-isnt-boring/https://drlinclark.com/articles/education-programs/tabletop-that-isnt-boring/Thu, 29 Oct 2026 15:55:22 +0000Education and trainingMost tabletop exercises are a slide deck read aloud. People nod, agree the plan is fine, and leave. Then the real incident arrives and the plan isn't fine.Cybersecurity Training That Changes What People Actually Do — field noteshttps://drlinclark.com/articles/education-programs/cybersecurity-training-programs-that-change-behavior-field-notes/https://drlinclark.com/articles/education-programs/cybersecurity-training-programs-that-change-behavior-field-notes/Thu, 29 Oct 2026 15:55:22 +0000Education and trainingAn employee finishes the annual cybersecurity course, answers the quiz, and gets a certificate. The dashboard turns green. Two weeks later, the same organiza...SOC analyst traininghttps://drlinclark.com/articles/education-programs/soc-analyst-training/https://drlinclark.com/articles/education-programs/soc-analyst-training/Thu, 29 Oct 2026 15:55:22 +0000Education and trainingI would not begin SOC analyst training by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...Adversary emulation educationhttps://drlinclark.com/articles/education-programs/adversary-emulation-education/https://drlinclark.com/articles/education-programs/adversary-emulation-education/Thu, 29 Oct 2026 15:55:22 +0000Education and trainingI would not begin adversary emulation education by buying another platform or launching a large programme. I would find the boundary, the accountable owner, ...Threat intelligence requirementshttps://drlinclark.com/articles/intelligence-osint/threat-intelligence-requirements/https://drlinclark.com/articles/intelligence-osint/threat-intelligence-requirements/Thu, 29 Oct 2026 15:55:22 +0000Threat intelligence and OSINTI would not begin threat intelligence requirements by buying another platform or launching a large programme. I would find the boundary, the accountable owne...Threat actor attributionhttps://drlinclark.com/articles/intelligence-osint/threat-actor-attribution/https://drlinclark.com/articles/intelligence-osint/threat-actor-attribution/Thu, 29 Oct 2026 15:55:22 +0000Threat intelligence and OSINTI would not begin threat actor attribution by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and o...OSINT verificationhttps://drlinclark.com/articles/intelligence-osint/osint-verification/https://drlinclark.com/articles/intelligence-osint/osint-verification/Thu, 29 Oct 2026 15:55:22 +0000Threat intelligence and OSINTI would not begin OSINT verification by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...What attackers learn from your job advertshttps://drlinclark.com/articles/intelligence-osint/what-attackers-learn-from-your-job-ads/https://drlinclark.com/articles/intelligence-osint/what-attackers-learn-from-your-job-ads/Thu, 29 Oct 2026 15:55:22 +0000Threat intelligence and OSINTA job advert for a security engineer that lists your SIEM, your EDR, your cloud provider and your identity platform is a map. Attackers read them.Indicator lifecyclehttps://drlinclark.com/articles/intelligence-osint/indicator-lifecycle/https://drlinclark.com/articles/intelligence-osint/indicator-lifecycle/Thu, 29 Oct 2026 15:55:22 +0000Threat intelligence and OSINTI would not begin indicator lifecycle by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...Source reliabilityhttps://drlinclark.com/articles/intelligence-osint/source-reliability/https://drlinclark.com/articles/intelligence-osint/source-reliability/Thu, 29 Oct 2026 15:55:22 +0000Threat intelligence and OSINTI would not begin source reliability by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...