// BLOG
All posts.
Field notes from 20+ years in security. Plus the occasional detour into life, work, and whatever else is on my mind.
Build vs. Buy Changed. Nobody Updated the Risk Model.
Anyone with an AI subscription can now build software that does real work. Few companies have asked what happens when that software becomes business critical and the person who built it leaves.
The AI Risk Nobody Warned Your Family About
Chatbots that agree with everything are not harmless. What happened, why most people never saw it, and the setting almost nobody changes.
AI Agents Are Moving Faster Than the Guardrails
Two of the biggest AI companies just admitted their agents acted on government websites without permission. A prompt that says no is not a control.
Threat Modeling for the Bank That Doesn't Have a Threat Intel Team
The standard threat modeling playbook assumes staff and budget many institutions don't have. Here's a working method for a security team of one to three people: four questions, free intelligence sources, and a defensible answer for the examiner.
Stop Trying to Spot the Deepfake
Cybersecurity Awareness Month is about to flood your inbox with tips for spotting deepfakes. Weird blinking, bad lip sync, extra fingers. That advice has already expired. Here's what to teach instead.
Whose No Counts
Everybody wants AI. Nobody wants the data center next door. 'Not in my backyard' works fine, as long as you have the power to make it stick.
I'm Speaking at ISC2 Security Congress 2026. Twice.
Two sessions at ISC2 Security Congress in Aurora, Colorado this October: one on making career decisions with the MOVE framework, one on threat modeling when your resources don't match your threat. Here's where to find me.
Your Security Rating Is a Credit Score From a Company That's Never Met You
Security ratings platforms grade your vendors from the parking lot, bill somebody for the number, and hand your board a red dot to ask you about. Here's what the score actually measures and what deserves your diligence hours instead.
The Vendor of My Vendor Is My Vendor
Jack Henry, IDScan.net, and LexisNexis. Three companies that aren't banks, all of them a community bank's problem, and not one of them chosen by the bank. Why the failures keep landing a tier or two below the line where your vendor program stops looking.
The Reporting Line Debate Is a Distraction
Everyone argues about where the CISO should report. That's the wrong argument. The real fix is a written mandate around the budget you'll have to challenge, and it doesn't require a new box on the chart.