Chris can be found charging round the countryside on a mountain bike, he’s large, hairy, often wears a kilt, and is often on stage with a cuppa tea trying to explain to audiences why they must ask more questions before clicking life’s big red button.
Context: Threat intelligence (TI, CTI) is one of the most misunderstood and misused disciplines in security. The term has been stretched, diluted, and rebranded so thoroughly that "threat intelligence" today can mean anything from: * A feed of IOCs (IPs, hashes, domains), often stale by the time you see
GRC is exactly where this all things we’re talking about ties together (or doesn't, which is the real problem). It's also one of the most over-promised and under-delivered categories in security, because vendors have spent the last 5 years rebranding spreadsheets-with-workflow
Onward. This is a topic where the market has exploded in the last few years, every consultant with a CISSP now offers "vCISO services," and every MSP has rebranded as "MSSP." Quality varies wildly, and buyers often can't tell the difference between strategic security
Onward to a topic where vendor quality varies enormously and the buyer often can't tell the difference between elite and mediocre work, which is exactly how mediocre vendors stay in business. Context: This is one of the most opaque categories in security purchasing. You're buying a
We’re going to consolidate the two email-related bullets into one comprehensive deep-dive, because the questions you'd ask vendors and the questions you'd ask yourself about getting email security right are deeply intertwined. This will be one of the longer topics on the list
Let's tackle the next one, which is a bit different in shape because it's not really a "vendor question" topic, it's an architectural decision framework. So I'm going to adapt the format slightly: questions you should ask yourself, your team,
Onwards to a category that has exploded in acronyms and vendor consolidation faster than anyone can keep up. Cloud security is genuinely complex, but vendors have made it sound more complex than it needs to be, in order to sell you platforms. Context: Let me decode the alphabet soup first,
Identity is arguably the most important topic on this list, because identity is the new perimeter, and most breaches in the last five years have involved compromised credentials, over-privileged accounts, or identity infrastructure that was poorly understood, let alone defended. Context: * IAM (Identity & Access Management), the system of
This is a category that's quietly becoming one of the most fragmented and confusing in security, because every vendor in adjacent spaces (CSPM, EDR, penetration testing, threat intel) has shipped some kind of "attack surface" feature and now claims to do VM/ASM/EASM. Let'
Onward to a topic where the marketing has gotten especially aggressive lately: the "autonomous SOC" and the army of vendors promising to replace your analysts with bots. Context: This is a hot, messy category. You'll hear pitches like "autonomous SOC," "AI SOC analyst,
SIEM has been "dying" for a decade and yet somehow keeps getting more expensive. SOAR was supposed to fix the analyst shortage and mostly didn't. Log management is where most organizations actually live but rarely budget honestly for. Let's untangle it. Context: SIEM (Security
This space is mature, crowded, and genuinely confusing because vendors have blurred the lines between EDR, XDR, and MDR to the point where the acronyms are nearly meaningless in marketing materials. Let's fix that. Context: EDR (Endpoint Detection & Response) protects endpoints. XDR (Extended Detection & Response) promises