Risk and Cyber

tl;dr Benchmarking is a waste of time when focused solely on inputs (e.g. budgets) rather than outcomes (e.g. effectiveness of controls).

It is tempting to compare cybersecurity to a chess game.

We’re all talking about the tidal wave of vulnerabilities that is upon us, with repeated waves likely coming.

Security breaches are often not the result of awesome attacker capabilities or the sudden emergence of sophisticated zero-day exploits.

Most people have been through at least one wave of technology transformation.

There’s still a bit of a tone in some security circles that we’re somehow unique in constantly having to push back against ill-advised moves, or even outright craziness, from our business, operations, or technology colleagues.

Everyone, no doubt, has an opinion on how many versions of the CISO role we have gone through since its inception.

Since I wrote the first version of this post some years ago much has changed.

At some point every leader needs to ask themselves: Do I really know what is going on in my company?

I suspect I’m not the only former or current financial markets technologist that sees parallels between the world of high frequency / algorithmic trading controls and what is needed for appropriate deterministic guardrails around our, mostly, non-determin…

I haven’t done a book review for a while and there’s no better way to get back to this than a look at Stewart Brand’s Maintenance of Everything .

We all need to advance our businesses and that is in many respects about selling.

I first wrote the original of this post over 4 years ago.

As we talked about in the last post , a world going through a massive AI-driven transition means speed becomes vital.

It’s not often that a force appears that totally re-orients everything in security.

The DORA AI Capabilities Model (DevOps Research and Asssesment, not the EU Digital Operational Resilience Act) report is well worth a read not just to get a perspective from the developer community but to look at the many security implications it uncovers.

Some time ago I saw a comment about the distinction between acting like a “watchmaker” or a “gardener” when undertaking organization transformations.

The most read posts in 2025 coalesced around the concept that successful cybersecurity is fundamentally a function of business leadership, strategic design, and sustainable execution .

This is the final of the series grouping together sets of prior posts into a particular theme.

This is part 6 of a 7 part series grouping together sets of prior posts into a particular theme.