Shorts
Short, self-contained pieces: one subject, one argument, a few minutes to read, sources at the end. When you need the full evidence, go to the research.
Dealing with one of these problems yourself? I work with organizations that need answers, not another slide deck. Let's talk.
What's in a five-angle short
Most subjects here are one page with five short sections, always in this order. Each has its own colour inside the article so you can jump to the one you need.
- 1Where I'd start: the first move I'd make, and the question I'd ask before spending anything.
- 2Where plans fail: where plans on this subject usually break, and the assumption I'd test first.
- 3Beyond the jargon: what the subject actually means once the vendor language is stripped out.
- 4What good looks like: the result that would tell you it worked, and the number I'd watch.
- 5The call leaders can't dodge: the decision leadership has to own, and what it needs on the table to make it.
-
Energy resilience
I would not begin energy resilience by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
ICS asset visibility
I would not begin ICS asset visibility by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...
-
Industrial Cybersecurity: Don't Break the Plant to Secure It
In an office, an aggressive security control may annoy somebody or interrupt a meeting. In a plant, water system, or transport environment, the same control ...
-
Industrial patching
I would not begin industrial patching by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
Industrial remote access
I would not begin industrial remote access by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and o...
-
Medical device security
I would not begin medical device security by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...
-
OT exercises
I would not begin OT exercises by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario ...
-
OT segmentation
I would not begin OT segmentation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenar...
-
SCADA incident response
I would not begin SCADA incident response by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...
-
Safety and security
I would not begin safety and security by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
The vendor's remote access to your plant
Ask a plant manager who can connect into the control network from outside and you'll usually get a confident answer. Ask for the list and it takes a week. Th...
-
Transportation systems
I would not begin transportation systems by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one...
-
Business interruption
I would not begin business interruption by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Cyber catastrophe modeling
I would not begin cyber catastrophe modeling by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and...
-
Cyber insurance
I would not begin cyber insurance by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenar...
-
Cyber investment prioritization
I would not begin cyber investment prioritization by buying another platform or launching a large programme. I would find the boundary, the accountable owner...
-
Cyber risk quantification
I would not begin cyber risk quantification by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and ...
-
Executive risk communication
I would not begin executive risk communication by buying another platform or launching a large programme. I would find the boundary, the accountable owner, a...
-
Loss scenarios
I would not begin loss scenarios by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
-
Risk appetite
I would not begin risk appetite by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario...
-
Security ROI
I would not begin security ROI by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario ...
-
Third-party concentration risk
I would not begin third-party concentration risk by buying another platform or launching a large programme. I would find the boundary, the accountable owner,...
-
What a breach actually costs, and why the headline number is wrong
The average-cost-of-a-breach figures that circulate every year are useful for one thing: convincing a board that the number isn't zero. For deciding what to ...
-
A Cybersecurity Course Is Not a Learning Program
A full training calendar proves that classes happened.
-
A tabletop exercise executives will actually remember
Most tabletop exercises are a slide deck read aloud. People nod, agree the plan is fine, and leave. Then the real incident arrives and the plan isn't fine.
-
Adversary emulation education
I would not begin adversary emulation education by buying another platform or launching a large programme. I would find the boundary, the accountable owner, ...
-
Competency assessment
I would not begin competency assessment by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Cyber curriculum design
I would not begin cyber curriculum design by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...
-
Cyber range development
I would not begin cyber range development by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...
-
Cybersecurity Hiring Starts With the Work, Not the Job Title
Ask five employers what a security engineer does and you'll get five different answers. One writes detections, another reviews cloud architecture, a third ad...
-
Cybersecurity Training That Changes What People Actually Do
An employee finishes the annual cybersecurity course, answers the quiz, and gets a certificate. The dashboard turns green. Two weeks later, the same organiza...
-
Executive cyber workshops
I would not begin executive cyber workshops by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and ...
-
Incident response exercises
I would not begin incident response exercises by buying another platform or launching a large programme. I would find the boundary, the accountable owner, an...
-
SOC analyst training
I would not begin SOC analyst training by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...
-
Skills gap analysis
I would not begin skills gap analysis by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
Stop Measuring Cybersecurity Training by Who Clicked Complete
A hundred percent training completion rate is an administrative achievement. It tells me people opened a course, clicked through it, and satisfied a requirem...
-
Training measurement
I would not begin training measurement by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...
-
Workforce development
I would not begin workforce development by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
A new security leader's first ninety days
The temptation is to arrive with a plan. The better move is to arrive with questions and leave with a plan the organisation recognises as its own.
-
A supplier got hit by ransomware. What do we do?
Cut their access to you first, then find out what of yours they held, then decide what you owe your own customers and regulators. The order, and the questions to put to the supplier.
-
Board advisory
I would not begin board advisory by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
-
Can executives and directors be held personally liable for a data breach?
Rarely for the breach itself. Readily for what happens after: concealment, false statements, and oversight that didn't exist. What the Uber and SolarWinds cases actually established.
-
Executive education
I would not begin executive education by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
Fractional CISO engagement
I would not begin fractional CISO engagement by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and...
-
Full-Time CISO or Fractional CISO: How Do You Decide?
Choose security leadership by decision authority, response coverage, execution capacity and independence. Compare fractional and full-time models before cost.
-
How to say no to the business without being overruled
Security leaders who say no a lot get routed around. Security leaders who never say no get blamed later. The way through isn't a better no; it's a better offer.
-
Incident leadership
I would not begin incident leadership by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
Is our cybersecurity budget enough? How to tell without a benchmark
Percent-of-IT benchmarks tell you what others spend, not what you need. Judge the budget by whether it closes your top risks, and whether you can prove it.
-
Keynote planning
I would not begin keynote planning by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Leading cross-functional teams
I would not begin leading cross-functional teams by buying another platform or launching a large programme. I would find the boundary, the accountable owner,...
Nothing matches. Try another word, or ask me directly.