// POSTS TAGGED "security-leadership"
Security Leadership.
All posts tagged security-leadership.
← back to all postsThe Reporting Line Debate Is a Distraction
Everyone argues about where the CISO should report. That's the wrong argument. The real fix is a written mandate around the budget you'll have to challenge, and it doesn't require a new box on the chart.
My Brain Is Built for Incidents. It's the Other 320 Days That Need a System.
The wiring that makes me lose my keys is the same wiring that goes calm and fast when everything is on fire. What twenty years in security taught me about working with my brain instead of against it.
The Authority Gap Is a Conflict of Interest Problem
Everyone agrees the CISO role is accountable for more than it controls. Almost nobody names the mechanism. Here's what actually has to change.
The Slow Call Is Still the Job
Security leadership rewards speed. The calls I am proudest of during an active incident were the ones I forced myself to slow down on. That is a trained discipline, not a personality trait, and most playbooks never write it down.
Your AI Policy Doesn't Cover the Part That Can Actually Hurt You
79% of organizations are deploying AI agents. 6% have updated their governance to match. The gap isn't in the models. It's in what those agents are connected to.
The CISO Who Buries Bad News Isn't Wrong. The System Is.
95% of CISOs feel pressured to suppress compliance findings. The industry response is that they need more backbone. That's the wrong read.
Your Incident Response Plan Is Modeling the Wrong Threat Actor
LockBit dominated tabletops for years. The ransomware ecosystem has rotated. The groups hitting organizations right now are not the ones your IR team practiced against, and that gap has consequences.
Your Tabletop Exercise Isn't Testing What You Think It Is
Most tabletop exercises are scripted theater that confirm what people already believe. Here's what actually breaks during a real incident, and how to design an exercise that finds it before someone else does.
Why Your Incident Response Plan Will Fail (And What to Build Instead)
Most IR plans fail not because they're poorly written, but because plans don't survive contact with reality. Here's how to build response capability instead of just documentation.
The Drinking Bird at the Nuclear Plant
Sam Altman wants to give AI full access to everything. Your users will too. Your AI security strategy isn't competing against attackers; it's competing against tedium. Tedium wins.