Chris can be found charging round the countryside on a mountain bike, he’s large, hairy, often wears a kilt, and is often on stage with a cuppa tea trying to explain to audiences why they must ask more questions before clicking life’s big red button.
A practical guide for security leaders who are done waiting for permission to engage with the above question. Context: Frontier models, the current generation of large language models and multimodal AI systems from Anthropic, OpenAI, Google, Meta, Mistral, and others, have crossed a threshold in 2025-2026 that makes the
We arrive at the topic that organizations most commonly skip until something goes very wrong. Application security and software supply chain risk sit at the intersection of development, operations, and security, and that intersection is where some of the largest, most consequential breaches of the last decade originated. Context: Three
Cyber insurance used to be a straightforward purchase. Pay a premium, describe your controls, collect if you're breached. The market has matured painfully and significantly since then, mostly because of repeated, expensive losses that forced insurers to get serious about what they're actually covering. Context: The
Topic 11 covered how to buy vCISO and managed security services. This topic covers what happens after you buy, because that's where most programs quietly fail. Context: The security services market has a dirty secret: the relationship that gets sold is almost never the relationship that gets delivered.
Supply chain compromise has gone from an edge case to one of the dominant attack vectors of the last five years. Yet most TPRM programs are still built around the same questionnaire-and-spreadsheet model that existed before SolarWinds. Let's fix that framing. Context: Third-Party Risk Management
This is the topic nobody wants to spend money on, until they desperately need it. And then they wish they'd spent a lot more. Context: Backup and recovery used to be an IT operations concern. Ransomware made it a security-critical, board-level conversation. The question is no
Let's tackle the most over-marketed, least-understood architecture shift in modern security, and the one where vendor salesmanship has done the most damage to actual outcomes. Context: A few definitions worth pinning down before the sales pitch arrives: * Zero Trust, a philosophy and architecture principle, not a
Context: Threat intelligence (TI, CTI) is one of the most misunderstood and misused disciplines in security. The term has been stretched, diluted, and rebranded so thoroughly that "threat intelligence" today can mean anything from: * A feed of IOCs (IPs, hashes, domains), often stale by the time you see
GRC is exactly where this all things we’re talking about ties together (or doesn't, which is the real problem). It's also one of the most over-promised and under-delivered categories in security, because vendors have spent the last 5 years rebranding spreadsheets-with-workflow
Onward. This is a topic where the market has exploded in the last few years, every consultant with a CISSP now offers "vCISO services," and every MSP has rebranded as "MSSP." Quality varies wildly, and buyers often can't tell the difference between strategic security
Onward to a topic where vendor quality varies enormously and the buyer often can't tell the difference between elite and mediocre work, which is exactly how mediocre vendors stay in business. Context: This is one of the most opaque categories in security purchasing. You're buying a
We’re going to consolidate the two email-related bullets into one comprehensive deep-dive, because the questions you'd ask vendors and the questions you'd ask yourself about getting email security right are deeply intertwined. This will be one of the longer topics on the list