Chris can be found charging round the countryside on a mountain bike, he’s large, hairy, often wears a kilt, and is often on stage with a cuppa tea trying to explain to audiences why they must ask more questions before clicking life’s big red button.
Onward to a topic where vendor quality varies enormously and the buyer often can't tell the difference between elite and mediocre work, which is exactly how mediocre vendors stay in business. Context: This is one of the most opaque categories in security purchasing. You're buying a
We’re going to consolidate the two email-related bullets into one comprehensive deep-dive, because the questions you'd ask vendors and the questions you'd ask yourself about getting email security right are deeply intertwined. This will be one of the longer topics on the list
Let's tackle the next one, which is a bit different in shape because it's not really a "vendor question" topic, it's an architectural decision framework. So I'm going to adapt the format slightly: questions you should ask yourself, your team,
Onwards to a category that has exploded in acronyms and vendor consolidation faster than anyone can keep up. Cloud security is genuinely complex, but vendors have made it sound more complex than it needs to be, in order to sell you platforms. Context: Let me decode the alphabet soup first,
Identity is arguably the most important topic on this list, because identity is the new perimeter, and most breaches in the last five years have involved compromised credentials, over-privileged accounts, or identity infrastructure that was poorly understood, let alone defended. Context: * IAM (Identity & Access Management), the system of
This is a category that's quietly becoming one of the most fragmented and confusing in security, because every vendor in adjacent spaces (CSPM, EDR, penetration testing, threat intel) has shipped some kind of "attack surface" feature and now claims to do VM/ASM/EASM. Let'
Onward to a topic where the marketing has gotten especially aggressive lately: the "autonomous SOC" and the army of vendors promising to replace your analysts with bots. Context: This is a hot, messy category. You'll hear pitches like "autonomous SOC," "AI SOC analyst,
SIEM has been "dying" for a decade and yet somehow keeps getting more expensive. SOAR was supposed to fix the analyst shortage and mostly didn't. Log management is where most organizations actually live but rarely budget honestly for. Let's untangle it. Context: SIEM (Security
This space is mature, crowded, and genuinely confusing because vendors have blurred the lines between EDR, XDR, and MDR to the point where the acronyms are nearly meaningless in marketing materials. Let's fix that. Context: EDR (Endpoint Detection & Response) protects endpoints. XDR (Extended Detection & Response) promises
Let's kick this off with the topic that's causing the most vendor-induced headaches in 2026. Context: Every vendor now claims to be "AI-powered." Most aren't, in any meaningful sense. Some bolted a GPT wrapper onto their UI last quarter. Others
Sid, Claude, and I were talking: We work in a cybersecurity industry that is filled with over-promises and under-delivery. Being a CISO, CTO, or leader working inside a "regular" company, whether that's healthcare, manufacturing, finance, or simply a local business that doesn't
There’s things in life that I’ve come to learn need to be held to either the three strikes, or fail fast rule. Be it cars, technology, people, places, or jobs. It’s not perfect, but it is something I know at the back of my mind I often