Shorts
Short, self-contained pieces: one subject, one argument, a few minutes to read, sources at the end. When you need the full evidence, go to the research.
Dealing with one of these problems yourself? I work with organizations that need answers, not another slide deck. Let's talk.
What's in a five-angle short
Most subjects here are one page with five short sections, always in this order. Each has its own colour inside the article so you can jump to the one you need.
- 1Where I'd start: the first move I'd make, and the question I'd ask before spending anything.
- 2Where plans fail: where plans on this subject usually break, and the assumption I'd test first.
- 3Beyond the jargon: what the subject actually means once the vendor language is stripped out.
- 4What good looks like: the result that would tell you it worked, and the number I'd watch.
- 5The call leaders can't dodge: the decision leadership has to own, and what it needs on the table to make it.
-
Security culture
I would not begin security culture by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Security leadership hiring
I would not begin security leadership hiring by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and...
-
Security leadership transition
I would not begin security leadership transition by buying another platform or launching a large programme. I would find the boundary, the accountable owner,...
-
Should the CISO report to the CIO or the CEO?
The reporting line matters less than three things: an unfiltered path to the board, authority to stop work, and a budget the CIO can't quietly reallocate. How to get them under either structure.
-
Technical workshop design
I would not begin technical workshop design by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and ...
-
The CISO just resigned. What do we do in the next 30 days?
Name an interim owner today, secure the credentials and the relationships, keep the regulatory designations valid, and don't rush the hire. The 30-day plan.
-
What a Cybersecurity Board Report Should Actually Answer
A board doesn't need a guided tour of the security dashboard. It needs to know what could go wrong, how badly the organization could be hurt, whether the def...
-
What should a new CISO deliver in the first 90 days?
An honest picture of where the organisation stands, the three risks that matter most, a plan with dates, and a working incident process. Not a new tool. What to expect, and how to judge it.
-
What should the board ask the CISO? Seven questions that get real answers
Skip 'are we secure?' Ask what would hurt us most, how we'd know, who decides, what we've tested, and what you need from us. Seven questions and the answers to expect.
-
Who can accept a cyber risk on behalf of the company?
The executive who owns the business outcome the risk threatens, within limits the board has set, in writing, with an expiry date. Not the security team, and not whoever wants the project to ship.
-
Will our cyber insurance actually pay? What to check before renewal
It pays if the controls you attested to were running, you notified on time, you used approved vendors, and the loss isn't excluded. Five things to check before you renew.
-
Chain of custody
I would not begin chain of custody by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Cloud forensics
I would not begin cloud forensics by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenar...
-
Disk forensics
I would not begin disk forensics by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
-
Don't turn it off: what to do in the first ten minutes
The instinct is to pull the plug. Sometimes that's right. Often it destroys the evidence that would tell you what happened and how far it went.
-
Email investigations
I would not begin email investigations by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...
-
Forensic reporting
I would not begin forensic reporting by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Fraud evidence
I would not begin fraud evidence by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
-
Malware triage
I would not begin malware triage by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
-
Memory forensics
I would not begin memory forensics by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Network forensics
I would not begin network forensics by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
Timeline reconstruction
I would not begin timeline reconstruction by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...
-
AI voice impersonation
I would not begin AI voice impersonation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one...
-
Account takeover
I would not begin account takeover by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
BEC prevention
I would not begin BEC prevention by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
-
Fraud awareness training
I would not begin fraud awareness training by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and o...
-
Fraud incident response
I would not begin fraud incident response by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...
-
Fraud investigations
I would not begin fraud investigations by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...
-
Insider-enabled fraud
I would not begin insider-enabled fraud by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Payment fraud controls
I would not begin payment fraud controls by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one...
-
Phishing detection
I would not begin phishing detection by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Synthetic identity fraud
I would not begin synthetic identity fraud by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and o...
-
The call from the CEO that wasn't
Voice cloning has made a familiar scam faster. The script hasn't changed: urgency, authority, secrecy, and a payment. What's changed is that the voice on the...
-
A Cybersecurity Gap Analysis That Actually Tells You What to Fix
I've read enough security reports to know that a hundred findings can leave an executive with fewer answers than when the assessment began. A gap analysis sh...
-
Board cyber reporting
I would not begin board cyber reporting by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Cyber crisis leadership
I would not begin cyber crisis leadership by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...
-
Cyber insurance readiness
I would not begin cyber insurance readiness by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and ...
-
Executive risk acceptance
I would not begin executive risk acceptance by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and ...
-
Gap analysis
I would not begin gap analysis by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario ...
-
M&A cyber diligence
I would not begin M&A cyber diligence by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
Policy enforcement
I would not begin policy enforcement by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Security budgeting
I would not begin security budgeting by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Security roadmaps
I would not begin security roadmaps by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
The Security Exception That Became Permanent
Exceptions are unavoidable. A legacy system cannot support a control, a vendor needs unusual access, or a deadline makes a proper fix inconvenient.
-
The risk register nobody reads
Most risk registers are write-only. Items go in during an audit, get a colour, and stay there until the next audit changes the colour. Nobody decides anythin...
-
Vendor governance
I would not begin vendor governance by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
You've got the pen test report. Now what?
The report lands, it's forty pages, and it has three criticals, eleven highs, and a long tail. Then it goes into a tracker and the next test finds most of th...
-
Your Cybersecurity Gap Assessment Is Finished. Now What?
The assessment is complete, the findings have been presented, and everybody agrees there is work to do. Three months later, the high-risk items are still ope...
-
Access reviews
I would not begin access reviews by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
-
Break-glass accounts: the exception that becomes the breach
Every environment needs a way in when everything else fails. Every environment I've seen has at least one such account that's been used for something other t...
Nothing matches. Try another word, or ask me directly.