Long-form. Technical. Every Wednesday. The things you already know you should be doing.
-
Encryption at the edge is mostly solved, but most organizations still hand off plaintext the moment traffic crosses an internal boundary they decided to call 'trusted.'
-
You cannot apply the right controls to data you have never bothered to label, which is why data classification remains the unglamorous prerequisite that every protection program skips and every incident response team pays for later.
-
Nearly every outage and most breaches trace back to a change nobody reviewed, yet change management remains the control everyone claims to have and almost nobody actually runs.
-
Retrofitted security controls cost more and catch less than designed-in ones, and CISA's Secure by Design framework explains why the bolt-on habit persists despite everyone knowing better.
-
Firewalls were built to protect a network topology that no longer exists, and until you treat identity as the actual perimeter (the way NIST SP 800-207 tells you to), you are just guarding an empty building.
-
A SIEM drowning in noise provides the same security value as no SIEM at all, and the fix is disciplined detection engineering grounded in MITRE ATT&CK rather than more log volume.
-
Injection flaws have topped security lists for decades not because we lack solutions, but because developers keep treating data as code and trusting input that was never trustworthy.
-
You cannot defend infrastructure you've never counted, and the assets that get you owned are almost always the ones nobody remembered existed.
-
Annual phishing-quiz compliance training teaches people to pass quizzes, not to resist attacks, and CIS Control 14 asks for something far harder: role-specific skills that hold up under pressure.
-
The admin/admin problem never dies; it just migrates to whatever new class of infrastructure you weren't watching, and CIS Control 4 is the map you keep refusing to read.
-
Every organization claims it has backups, but far fewer can prove those backups restore under pressure, and ransomware crews have built a business model on the difference.
-
A ready incident response plan that has never been exercised isn't a capability at all, just a document waiting to fail you in the worst possible way.
-
Segmentation isn't a diagram you draw once and file away, it's an assumption you have to prove every time it matters, and flat networks that pass audits still collapse the moment an attacker gets a foothold.
-
Your vendors inherit your trust and export their weaknesses to you, and NIST's GV.SC exists precisely because almost nobody manages that relationship past the initial questionnaire.
-
Everyone collects logs; almost nobody reads them, and the gap between compliance logging and operational detection is where breaches live undetected for months.
-
A patching policy is a document; patching is a measurable outcome, and the gap between the two is where most organizations quietly live.
-
Everyone writes a least-privilege policy and almost no one enforces it; here's the gap between the document and an access review that actually revokes something.
-
Push-based MFA was supposed to kill phishing and credential reuse, but by turning authentication into a single fatigued tap, it became a new attack surface, and NIST has been quietly telling you to fix it for years.