The Boardroom Brief.

When a security team asks me to help them hire, they almost always hand me a job description that is a list of tools. Five years…

Mean time to resolve is the metric every security operations deck leads with, and it is quietly one of the most misleading numbers we report. Not…

Most tabletop exercises are theater with a script everyone has already read. The scenario is announced weeks ahead. The right people clear their calendars. The injects…

Every few years our industry meets a vulnerability class it treats as unprecedented, panics, and slowly realizes it has seen the shape before. Prompt injection is…

I have filled out hundreds of vendor security questionnaires, and I have sent out hundreds more. I can tell you with confidence that the process, as…

“We implemented least privilege” is one of those sentences that sounds like an achievement and is almost always a lie — not a deliberate one, but…

Every security program I have inherited comes with one: a spreadsheet, dozens of rows, colour-coded, an “owner” column, a “target date” column mostly populated with dates…

Somewhere in your company right now, someone is pasting a customer contract into a consumer chatbot to summarize it. Someone in finance is asking a public…