// POSTS TAGGED "security-leadership"
Security Leadership.
All posts tagged security-leadership.
← back to all postsThe Slow Call Is Still the Job
Security leadership rewards speed. The calls I am proudest of during an active incident were the ones I forced myself to slow down on. That is a trained discipline, not a personality trait, and most playbooks never write it down.
Your AI Policy Doesn't Cover the Part That Can Actually Hurt You
79% of organizations are deploying AI agents. 6% have updated their governance to match. The gap isn't in the models. It's in what those agents are connected to.
The CISO Who Buries Bad News Isn't Wrong. The System Is.
95% of CISOs feel pressured to suppress compliance findings. The industry response is that they need more backbone. That's the wrong read.
Your Incident Response Plan Is Modeling the Wrong Threat Actor
LockBit dominated tabletops for years. The ransomware ecosystem has rotated. The groups hitting organizations right now are not the ones your IR team practiced against, and that gap has consequences.
Your Tabletop Exercise Isn't Testing What You Think It Is
Most tabletop exercises are scripted theater that confirm what people already believe. Here's what actually breaks during a real incident, and how to design an exercise that finds it before someone else does.
Why Your Incident Response Plan Will Fail (And What to Build Instead)
Most IR plans fail not because they're poorly written, but because plans don't survive contact with reality. Here's how to build response capability instead of just documentation.
The Drinking Bird at the Nuclear Plant
Sam Altman wants to give AI full access to everything. Your users will too. Your AI security strategy isn't competing against attackers; it's competing against tedium. Tedium wins.
Do You Need a Fractional CISO? Here's How to Tell
Not sure if you need security leadership yet? Here's when a fractional CISO makes sense, what your options look like, and how to avoid overspending on security too early.
When Perfect Plans Meet Imperfect Reality
Sometimes the consequences of IR plan failure aren't just about downtime or data. Sometimes they're about life and death.
The Question That Made Everyone in the Room Go Silent
I asked one simple question about incident response plans. The silence that followed told me everything I needed to know.