// BLOG
All posts.
Field notes from 20+ years in security. Plus the occasional detour into life, work, and whatever else is on my mind.
The Vendor of My Vendor Is My Vendor
Jack Henry, IDScan.net, and LexisNexis. Three companies that aren't banks, all of them a community bank's problem, and not one of them chosen by the bank. Why the failures keep landing a tier or two below the line where your vendor program stops looking.
The Reporting Line Debate Is a Distraction
Everyone argues about where the CISO should report. That's the wrong argument. The real fix is a written mandate around the budget you'll have to challenge, and it doesn't require a new box on the chart.
My Brain Is Built for Incidents. It's the Other 320 Days That Need a System.
The wiring that makes me lose my keys is the same wiring that goes calm and fast when everything is on fire. What twenty years in security taught me about working with my brain instead of against it.
The Most Expensive Attack on Your Bank Won't Use Malware
Business email compromise still outearns ransomware every year, and it beats banks that have EDR, MFA, and a clean exam. The control that stops it is a process, not a product, and most institutions never test it.
The Authority Gap Is a Conflict of Interest Problem
Everyone agrees the CISO role is accountable for more than it controls. Almost nobody names the mechanism. Here's what actually has to change.
My AI Knows I'm a Woman. It Still Writes About 'The Guy.'
My heavily personalized AI assistant defaulted a hypothetical founder to male, again. The misgendering is the visible symptom. The disease is that tuning buys you polish, not trust.
The Slow Call Is Still the Job
Security leadership rewards speed. The calls I am proudest of during an active incident were the ones I forced myself to slow down on. That is a trained discipline, not a personality trait, and most playbooks never write it down.
Your Vendor's Auditor Is Also a Vendor
SR Bancorp's breach came through the firm hired to audit its controls. Most vendor risk programs never ask who has access to the data behind the audit itself.
When Your Vendor Gets Breached, You Find Out Last
A fintech software vendor got hit with ransomware and up to 1.35 million banking customers were exposed. Most of their banks did the questionnaire, got the SOC 2, and still found out months late. The control that matters isn't the one you audited.
You Gave the AI Agent the Keys. That's the Breach.
Enterprise AI agent fleets doubled in four months and only about one in five are governed before they go live. When one gets breached, there's usually no clever attack behind it. Just an agent doing exactly what it was allowed to do.