The Boardroom Brief.

Every incident response plan looks great in the binder. Then something actually happens at 2 a.m., the person who wrote the plan is on vacation, nobody…

For most of my career, the worst case for a breach was data — records stolen, systems down, a bad week and a hard quarter. Then…

Here’s an uncomfortable truth I’ve had to explain in a lot of boardrooms: some of your most dangerous risk isn’t inside your company at all. It’s…

Somewhere in your company right now there’s a dashboard showing fourteen thousand open vulnerabilities, and it is actively making you less safe. Not because the number…

I spent a stretch inside one of the largest banks in the country, and the problem sitting on my desk was deceptively boring: make sure thousands…

I’ve led a SOC 2 Type II certification from a blank page. I’ve also been called in to clean up after companies that had a spotless…

The first time I briefed a board of directors on security, I made every mistake at once. I put a threat-actor kill chain on a slide.…