You know, I’ve been wondering what to say, or how to say it, or simply SHOULD I even say something, but sitting here looking out of the window of the metal tube that's propelling me back to a world that is broken. Good people are out of
What a Conversation About Headphone Amps Taught Me About AI Posted by Chris Roberts, Sid, AND Claude So, this is going to take a slight detour….bear with me, there's a point. A few weeks back I had a long conversation with Google's Gemini AI about
A practical guide for security leaders who are done waiting for permission to engage with the above question. Context: Frontier models, the current generation of large language models and multimodal AI systems from Anthropic, OpenAI, Google, Meta, Mistral, and others, have crossed a threshold in 2025-2026 that makes the
We arrive at the topic that organizations most commonly skip until something goes very wrong. Application security and software supply chain risk sit at the intersection of development, operations, and security, and that intersection is where some of the largest, most consequential breaches of the last decade originated. Context: Three
Cyber insurance used to be a straightforward purchase. Pay a premium, describe your controls, collect if you're breached. The market has matured painfully and significantly since then, mostly because of repeated, expensive losses that forced insurers to get serious about what they're actually covering. Context: The
Topic 11 covered how to buy vCISO and managed security services. This topic covers what happens after you buy, because that's where most programs quietly fail. Context: The security services market has a dirty secret: the relationship that gets sold is almost never the relationship that gets delivered.
Supply chain compromise has gone from an edge case to one of the dominant attack vectors of the last five years. Yet most TPRM programs are still built around the same questionnaire-and-spreadsheet model that existed before SolarWinds. Let's fix that framing. Context: Third-Party Risk Management
This is the topic nobody wants to spend money on, until they desperately need it. And then they wish they'd spent a lot more. Context: Backup and recovery used to be an IT operations concern. Ransomware made it a security-critical, board-level conversation. The question is no
Let's tackle the most over-marketed, least-understood architecture shift in modern security, and the one where vendor salesmanship has done the most damage to actual outcomes. Context: A few definitions worth pinning down before the sales pitch arrives: * Zero Trust, a philosophy and architecture principle, not a
Context: Threat intelligence (TI, CTI) is one of the most misunderstood and misused disciplines in security. The term has been stretched, diluted, and rebranded so thoroughly that "threat intelligence" today can mean anything from: * A feed of IOCs (IPs, hashes, domains), often stale by the time you see
GRC is exactly where this all things we’re talking about ties together (or doesn't, which is the real problem). It's also one of the most over-promised and under-delivered categories in security, because vendors have spent the last 5 years rebranding spreadsheets-with-workflow
Onward. This is a topic where the market has exploded in the last few years, every consultant with a CISSP now offers "vCISO services," and every MSP has rebranded as "MSSP." Quality varies wildly, and buyers often can't tell the difference between strategic security