// BLOG
All posts.
Field notes from 20+ years in security. Plus the occasional detour into life, work, and whatever else is on my mind.
Stop Protecting Systems, Start Protecting Data
Why modern security strategies must shift from system-centric defenses to data-centric protection approaches.
When Your Bank Examiner Says 'Risk Assessment' and You Break Out in Hives
Why most cybersecurity guidance for community banks is useless, and what to do instead
Vibe Coding: How to Write Secure Code When AI Does the Heavy Lifting
AI coding tools are powerful, but they're trained on decades of mediocre code. Here's how to harness them without inheriting every security mistake we've been making since the 90s.
How to Respond When Your Customer Sends You a Security Questionnaire
Your biggest deal just sent a 200-question security assessment. Here's your step-by-step playbook for responding without losing the deal or your mind.
How to Get SOC 2 Certified: Startup Guide (Costs $15K-50K, Takes 3-6 Months)
How much does SOC 2 cost? $15K-50K for audit + $5K-30K/year in tools. Real timeline: 3-6 months prep + 4-8 weeks audit. Here's what you actually need (and what you can skip).
Feats of Endurance and Stupidity: What Running in Circles Teaches Us About Cybersecurity
What ultramarathon running teaches us about incident response and cybersecurity resilience. Lessons from a CISO on training for chaos, mental endurance, and why preparation beats reaction.
From Jewels to Data: Why We Never Learn
The Louvre got robbed. Companies get breached. Both could've been prevented. Here's why waiting for the 'oh crap' moment is a terrible security strategy.
Do You Need a Fractional CISO? Here's How to Tell
Not sure if you need security leadership yet? Here's when a fractional CISO makes sense, what your options look like, and how to avoid overspending on security too early.
The Engineered Forest: Why the Best Security Programs Are Invisible
What a carefully managed New Hampshire forest taught me about building security programs that enable rather than block. The best security, like the best ecosystems, looks effortless but is intentionally designed.
Is Your 'Smart' Device Actually Smart? A Simple Test
Before connecting that next device to WiFi, ask one question: does the benefit actually outweigh the risk? A security professional's practical guide to smart home decisions.