Governance and risk
Everything I've written on governance and risk, with the research pieces first. Each one ends with something you can do on Monday.
Dealing with one of these problems yourself? I work with organizations that need answers, not another slide deck. Let's talk.
What's in a five-angle short
Most subjects here are one page with five short sections, always in this order. Each has its own colour inside the article so you can jump to the one you need.
- 1Where I'd start: the first move I'd make, and the question I'd ask before spending anything.
- 2Where plans fail: where plans on this subject usually break, and the assumption I'd test first.
- 3Beyond the jargon: what the subject actually means once the vendor language is stripped out.
- 4What good looks like: the result that would tell you it worked, and the number I'd watch.
- 5The call leaders can't dodge: the decision leadership has to own, and what it needs on the table to make it.
-
How Do You Set a Sustainable Workload for a Security Team?
Set security-team workload from recurring demand, scarce skills and incident capacity. Use explicit intake limits, honest queue measures and operating tradeoffs.
-
How Do You Test an AI Workflow That Says Done but Gets It Wrong?
Test AI false completion with independent outcome checks, realistic failure cases, calibrated evaluators, and release gates that expose consequential errors.
-
How Do You Turn a Cybersecurity Gap Assessment Into a Remediation Plan?
Turn assessment findings into a defensible remediation plan with evidence checks, shared dependencies, realistic staffing and testable acceptance criteria.
-
What Evidence Is Required to Close a Security Exception?
Learn what evidence closes a security exception: scope-matched control tests, current assumptions, accountable review and clear residual-risk decisions.
-
What Evidence Should You Check Before Signing a Cyber Insurance Application?
Verify cyber insurance answers against actual systems, access paths, test results and exceptions before signing, with a reproducible control-evidence method.
-
What Security Evidence Should You Require Before Approving a Critical Supplier?
Evaluate critical suppliers beyond questionnaires: match evidence to the service, test consequential claims, resolve exceptions and define approval conditions.
-
Who Owns a Hostname After Its Service Is Retired?
Retire exposed hostnames without leaving dangling DNS or trusted vendor access. Assign responsibility, sequence the changes and verify what actually closed.
-
Your Cybersecurity Gap Assessment Is Finished. Now What?
A cybersecurity gap assessment is only useful when its findings change budgets, ownership, priorities and operational decisions.
-
A Cybersecurity Gap Analysis That Actually Tells You What to Fix
I've read enough security reports to know that a hundred findings can leave an executive with fewer answers than when the assessment began. A gap analysis sh...
-
Board cyber reporting
I would not begin board cyber reporting by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Cyber crisis leadership
I would not begin cyber crisis leadership by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...
-
Cyber insurance readiness
I would not begin cyber insurance readiness by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and ...
-
Executive risk acceptance
I would not begin executive risk acceptance by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and ...
-
Gap analysis
I would not begin gap analysis by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario ...
-
M&A cyber diligence
I would not begin M&A cyber diligence by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
Policy enforcement
I would not begin policy enforcement by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Security budgeting
I would not begin security budgeting by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Security roadmaps
I would not begin security roadmaps by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
The Security Exception That Became Permanent
Exceptions are unavoidable. A legacy system cannot support a control, a vendor needs unusual access, or a deadline makes a proper fix inconvenient.
-
The risk register nobody reads
Most risk registers are write-only. Items go in during an audit, get a colour, and stay there until the next audit changes the colour. Nobody decides anythin...
-
Vendor governance
I would not begin vendor governance by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
You've got the pen test report. Now what?
The report lands, it's forty pages, and it has three criticals, eleven highs, and a long tail. Then it goes into a tracker and the next test finds most of th...
-
Your Cybersecurity Gap Assessment Is Finished. Now What?
The assessment is complete, the findings have been presented, and everybody agrees there is work to do. Three months later, the high-risk items are still ope...
Nothing matches. Try another word, or ask me directly.