// BLOG
All posts.
Field notes from 20+ years in security. Plus the occasional detour into life, work, and whatever else is on my mind.
Your Ransomware Negotiator Might Be Playing Both Sides
The DigitalMint conviction proves your IR vendor pre-vetting is part of your security program, not an afterthought. Here is what to ask before the next incident, not during it.
We Used to Have Pockets. Then Someone Took Them
A choir practice rant about why women's clothing has no real pockets, how that happened, and why a missing pocket was never really about the pocket.
The AI Questionnaire Your Vendors Aren't Ready For
Your vendors' employees are using AI tools. That means your data is flowing to model providers you've never assessed. Here are the questions to start asking.
Your Tabletop Exercise Isn't Testing What You Think It Is
Most tabletop exercises are scripted theater that confirm what people already believe. Here's what actually breaks during a real incident, and how to design an exercise that finds it before someone else does.
Concentration Risk Wasn't Just About Loans
Community banks have managed concentration risk for a century. Then we handed every customer record to a handful of SaaS aggregators. ShinyHunters is teaching us what that actually costs.
Your Vendor Questionnaire Doesn't Ask the Right OAuth Questions
Regulators have been citing 4th party risk for years. OAuth token chains are how it actually executes, and most vendor programs aren't built to catch it. Here's what to ask.
Phishing Tests Don't Work. Fight Me.
Phishing simulation click rates are a metric, not a security outcome. AI just made real phishing dramatically harder to spot. Your tests haven't caught up.
NIST Just Stopped Doing Part of Your Job. Now What?
NIST is no longer enriching every CVE in the National Vulnerability Database. If CVSS scores were the backbone of your vulnerability management program, you have a problem that predates this announcement.
Your AI Vendor Said Their Model Is Accurate, Explainable, and Compliant. Did They Prove It?
Community banks are getting pitched AI tools right now. Standard vendor due diligence doesn't cover what actually matters with AI. Here's what to ask before you sign anything.
How to Pick an MDR Provider When You're a Community Bank
Every MDR vendor says they do detection and response. Here's what to actually evaluate before you sign a contract, and the questions most community banks never think to ask.