Research & Analysis
Longer pieces with sources you can check. This is where I take a problem apart properly: the standards, the evidence, and what I'd actually do.
Dealing with one of these problems yourself? I work with organizations that need answers, not another slide deck. Let's talk.
-
Before You Give an AI Agent Permission to Act
AI agents can take action, not just answer questions. I examine permissions, tool access, human oversight and what it takes to keep automation accountable.
-
Before an AI Agent Can Act, Decide What It Must Never Touch
What I look at in AI agent permissions, the decisions it forces, and what credible evidence looks like before you spend.
-
Can You Trust a Signed Webhook to Update a Business Record?
Review webhook trust beyond signatures: tenant binding, replay, duplicate effects, event ordering and recovery after missed notifications.
-
Do Private Endpoints Prevent Cloud Data Exfiltration?
Assess private endpoints against destination ownership, service permissions and managed exports, then test the cloud data paths an egress firewall misses.
-
Does Privileged Access Really End When the Timer Expires?
Verify that temporary admin access ends across role assignments, cached decisions, sessions and delegated credentials while ordinary access keeps working.
-
Does the Vulnerable Component in Your SBOM Affect Your Service?
Trace an SBOM vulnerability match to deployed software, affected versions, execution paths and VEX evidence before closing or escalating the finding.
-
How Can You Test a PLC Backup Without Connecting to the Live Process?
Test PLC backups on isolated equipment, verify firmware and retained state, and distinguish a successful restore from evidence for a safe process restart.
-
How Can a Board Verify That Cyber Risk Is Improving?
Challenge cybersecurity risk trends with comparable measures, tested controls, explicit uncertainty and independent assurance tied to business consequences.
-
How Do You Assess Cybersecurity Candidates Before Hiring?
Design a cybersecurity hiring assessment around real tasks, observable evidence, consistent scoring and the capabilities a candidate needs on entry.
-
How Do You Assess Cybersecurity Skills Beyond Multiple-Choice Exams?
Build defensible cybersecurity assessments with observed tasks, clear rubrics, calibrated assessors and transfer tests. Separate completion from demonstrated competence.
-
How Do You Keep an AI Agent Within a Human Approval?
Bind AI-agent approval to the exact action, target and payload. Handle changed data, delegated credentials, retries and uncertain execution without widening consent.
-
How Do You Know Cybersecurity Training Changes Job Performance?
Measure cybersecurity training through job tasks, delayed retention and fair comparisons. Separate genuine improvement from easier tests and changed tools.
-
How Do You Know Whether Your SOC Is Actually Effective?
Assess SOC effectiveness with tested detection, defensible investigations and verified containment. Expose missed cases, handoff failures and misleading response averages.
-
How Do You Know a Cyber Tabletop Found a Real Response Gap?
Evaluate incident-response tabletop evidence, separate discussion from demonstrated capability, and verify that corrective actions close the gaps found.
-
How Do You Know a Security Control Still Works After a Change?
Keep security-control evidence valid after change: define retesting triggers, detect missing telemetry and bound the time to a defensible decision.
-
How Do You Make Data Classification Enforce Access Rules?
Turn classification labels into tested read, edit, export and sharing rules, accounting for attribute quality, copies, masking and policy changes.
-
How Do You Minimize Security Logs Without Losing Useful Evidence?
Decide which security-log fields to keep, transform or restrict, then test detection, identity resolution and retention before removing useful evidence.
-
How Do You Prove SaaS Access Has Ended After Offboarding?
Verify SaaS offboarding across accounts, sessions, tokens, integrations and shared content, with evidence of effective denial and explicit limits.
-
How Do You Reconstruct an OT Incident When Clocks Disagree?
Reconstruct OT incidents with timestamp uncertainty, source provenance and causal evidence, then verify time recovery against each function's requirements.
-
How Do You Safely Control and End OT Vendor Remote Access?
Authorize industrial vendor access for specific work, constrain the maintenance path, and verify that access ends without assuming the process is safe.
-
How Do You Set a Sustainable Workload for a Security Team?
Set security-team workload from recurring demand, scarce skills and incident capacity. Use explicit intake limits, honest queue measures and operating tradeoffs.
-
How Do You Stop AI Agents Acting on Instructions in Documents?
Constrain retrieved content with task-bound tool authorization, verified recipients, data-flow controls and approval checks that survive model mistakes.
-
How Do You Stop a RAG Assistant Revealing Documents After Access Is Revoked?
Trace revoked document access through RAG permissions, indexes, caches and conversations. Define a defensible revocation boundary and test it with synthetic data.
-
How Do You Test API Object Authorization Across Tenants?
Test API authorization with a decision matrix covering tenants, objects, fields, stale permissions and queued work. Learn what evidence supports a release decision.
-
How Do You Test DNS Failover Before a Recovery Cutover?
Test DNS failover across caches, private zones, DNSSEC and application connections before declaring a disaster recovery site ready for traffic.
-
How Do You Test Detection False Positives Before Enabling a Rule?
Test a detection rule with benign lookalikes, held-out data and shadow operation. Separate false-positive rate, alert precision, workload and release evidence.
-
How Do You Test an AI Workflow That Says Done but Gets It Wrong?
Test AI false completion with independent outcome checks, realistic failure cases, calibrated evaluators, and release gates that expose consequential errors.
-
How Do You Turn a Cybersecurity Gap Assessment Into a Remediation Plan?
Turn assessment findings into a defensible remediation plan with evidence checks, shared dependencies, realistic staffing and testable acceptance criteria.
-
How Do You Verify Data Deletion Across Backups and Vendors?
Verify data deletion across replicas, object versions, backups and vendors with scoped evidence, recovery tests, key checks and honest retention reporting.
-
How Do You Verify a Container Image's Build Attestation?
Verify the image digest, signer, builder, source and build parameters, then bind the result to the exact deployment and current release policy.
-
How Should Account Recovery Work with Phishing-Resistant MFA?
Design account recovery that verifies the claimant, constrains replacement enrollment, and ends old access without quietly weakening phishing-resistant MFA.
-
How Should Passkey Recovery Work on Shared Workplace Devices?
Design passkey recovery for shared terminals without leaving credentials, sessions or data for the next worker. Includes recovery gates and shift-change tests.
-
How Should a Company Approve Employee Use of Generative AI?
Approve employee AI use by task, data and account—not brand alone. Assess contracts, connectors, review capacity and conditions for withdrawing permission.
-
How to Prove a Ransomware Restore Is Ready for Production
Test recovery time, data loss, backup integrity and identity dependencies before returning a restored service to production after ransomware.
-
How to Revoke a Leaked Secret Without Breaking Services
Map every consumer of a leaked credential, revoke its effective authority, test the replacement, and investigate tokens or access it may have created.
-
How to Verify DMARC Across Every Legitimate Email Sender
Verify DMARC alignment across mailboxes, applications, vendors and forwarders, with receiver tests and evidence for an enforcement decision.
-
Should You Buy a New Security Tool or Improve the Controls You Have?
Compare security investments using operational evidence, full costs, implementation delays and uncertainty. Test when a new tool beats improving existing controls.
-
Stop Measuring Cybersecurity Training by Who Clicked Complete
A practical approach to cybersecurity training program development: role-based curricula, exercises, measurable skills and operational results.
-
The First Board Briefing After a Breach
An incident response briefing should separate facts, uncertainty and decisions. Here's how I would brief executives while an investigation is still moving.
-
Training Completion Is Not Cybersecurity Competence
What I look at in role based cybersecurity education, the decisions it forces, and what credible evidence looks like before you spend.
-
What Evidence Is Required to Close a Security Exception?
Learn what evidence closes a security exception: scope-matched control tests, current assumptions, accountable review and clear residual-risk decisions.
-
What Evidence Should You Check Before Signing a Cyber Insurance Application?
Verify cyber insurance answers against actual systems, access paths, test results and exceptions before signing, with a reproducible control-evidence method.
-
What Evidence Should You Require Before Approving an OT Security Change?
Evaluate OT security changes with operational requirements, representative tests, rollback limits and clear acceptance criteria before production deployment.
-
What Evidence Shows a Cyber Incident Is Contained?
Assess incident containment through blocked access paths, surviving sessions, trustworthy observations and explicit reopening conditions—not completed tickets.
-
What Security Evidence Should You Require Before Approving a Critical Supplier?
Evaluate critical suppliers beyond questionnaires: match evidence to the service, test consequential claims, resolve exceptions and define approval conditions.
-
What Should You Restore First After a Cyberattack?
Build a recovery sequence around service dependencies, trusted startup paths, staffing limits and transaction barriers—not a ranked list of servers.
-
What Should Zero trust Do When the Policy Service Is Down?
Design zero-trust access during policy-service outages: bound cached decisions, separate denial from errors, preserve essential work and verify recovery.
-
What Should a Post-Quantum Cryptographic Inventory Include?
Build a post-quantum inventory that connects algorithms, data lifetimes, trust dependencies and vendor constraints to a testable migration plan.
-
When Should Security Evidence Block a Green Software Release?
Decide whether a green build is ready to ship by checking test execution, security claims, contradictory evidence, exceptions and release scope.
-
When Should a Cyber Incident Trigger Executive Crisis Management?
Set cyber crisis triggers around business consequences, decision authority and time remaining—not alert counts or waiting for forensic certainty.
-
When Should a Cybersecurity Job Require a Certification?
Decide when cybersecurity certifications should be required, preferred or replaceable by equivalent evidence. Match credential claims to the actual job.
-
When Should a SOC Block an IP Address From a Threat Feed?
Decide when a threat-feed IP deserves blocking: assess source independence, freshness, shared-address risk, local evidence, scope and rollback.
-
When Vulnerability Scores Disagree, What Should You Fix First?
Reconcile CVSS, EPSS and CISA KEV with asset evidence, business consequences and patch constraints to choose a defensible next action.
-
Which Cloud Logs Must You Preserve Before an Incident?
Identify cloud logs needed to investigate account compromise, test collection and retention, and preserve evidence without overstating what it proves.
-
Which OT Cybersecurity Risks Should You Address First?
Prioritize OT cyber risks by process consequences, credible access paths and protective dependencies. Separate urgent exposure from safe change approval.
-
Who Is Responsible for Each Action During a Cloud Security Incident?
Map cloud incident actions to customer, provider and MSP authority. Test containment, evidence handoffs and emergency access before a real compromise.
-
Who Owns a Hostname After Its Service Is Retired?
Retire exposed hostnames without leaving dangling DNS or trusted vendor access. Assign responsibility, sequence the changes and verify what actually closed.
-
Who Should Own Cloud Workload Identities?
Assign responsibility for workload identity issuance, permissions and retirement, then verify who can obtain credentials and which access actually ends.
-
Your Board Needs a Decision, Not Another Security Dashboard
What I look at in cybersecurity board reporting, the decisions it forces, and what credible evidence looks like before you spend.
-
Your Cybersecurity Gap Assessment Is Finished. Now What?
A cybersecurity gap assessment is only useful when its findings change budgets, ownership, priorities and operational decisions.
Nothing matches. Try another word, or ask me directly.