// BLOG
All posts.
Field notes from 20+ years in security. Plus the occasional detour into life, work, and whatever else is on my mind.
Your Vendor Questionnaire Doesn't Ask the Right OAuth Questions
Regulators have been citing 4th party risk for years. OAuth token chains are how it actually executes, and most vendor programs aren't built to catch it. Here's what to ask.
Phishing Tests Don't Work. Fight Me.
Phishing simulation click rates are a metric, not a security outcome. AI just made real phishing dramatically harder to spot. Your tests haven't caught up.
NIST Just Stopped Doing Part of Your Job. Now What?
NIST is no longer enriching every CVE in the National Vulnerability Database. If CVSS scores were the backbone of your vulnerability management program, you have a problem that predates this announcement.
Your AI Vendor Said Their Model Is Accurate, Explainable, and Compliant. Did They Prove It?
Community banks are getting pitched AI tools right now. Standard vendor due diligence doesn't cover what actually matters with AI. Here's what to ask before you sign anything.
How to Pick an MDR Provider When You're a Community Bank
Every MDR vendor says they do detection and response. Here's what to actually evaluate before you sign a contract, and the questions most community banks never think to ask.
The FFIEC CAT Is Gone. Now What?
The FFIEC retired the Cybersecurity Assessment Tool. Here's what community banks actually need to do now, what examiners are looking for instead, and how to transition without starting from scratch.
The Framework Trap: When Compliance Kills Security
Security frameworks were built to guide programs, not replace thinking. Do security right and compliance follows. Here's why most organizations have it backwards.
I Spent Eight Hours on My Home Network. I'm Still Not Done.
A home network rebuild that's still in progress and already has lessons. Documentation debt is real, and it costs you more than a weekend.
Your Vendors Are Your Biggest Security Risk. Here's What to Do About It.
Most community banks can answer every question about their own security posture. But ask about their vendors, and you get silence. Here's how to fix that.
The Real AI Threat Isn't Job Loss. It's Irrelevance.
Everyone's worried AI will take their job. The bigger risk is becoming the person who can't keep up because you refused to learn how to use it.