Compliance

AI can now collect compliance evidence, map it to controls, identify gaps, draft policies, and write the narrative explaining how a company meets a requirement. AI didn't create the problem I want to talk about. It just makes the evidence cleaner, faster, and easier to produce.I've spent a large part of my career assessing security programs, working through compliance requirements, and helping companies fix what happens after the assessment is over. Long before AI entered the conversation, I saw the same issue over and over again. A company could show evidence that a control existed without necessarily proving that the control worked the way everyone thought it did.I don't think better evidence is a bad thing. I think we're going to see a lot more of it. The problem is what happens when we start confusing better evidence with better security.And that changes what we should be asking.What did compliance automation actually change?Tools like Vanta and Drata have improved a part of compliance that needed to improve.Anyone who has been through enough audits remembers the old process. Someone creates an evidence request list. Teams start taking screenshots. People chase control owners. Evidence gets dropped into folders. Spreadsheets track what is missing. Then everyone does it again during the next audit cycle.

Read More

Passing a compliance audit is important, but it doesn't necessarily mean you're secure. One of the most common things I see when assessing companies is that the issue isn't a lack of security investment. In many cases, they've bought the right tools, written the policies, implemented MFA, deployed endpoint security, configured backups, and completed the audit. On paper, the program looks good. The problem starts when you look at how those controls are actually being operated day to day.

Read More

AI governance isn't a technology problem. It's an ownership problem. Only 2% of small firms have a comprehensive AI governance framework, yet 88% of organizations are already using AI in at least one business function. Meanwhile, one in five data breaches now involves shadow AI , and in 97% of those cases, the breached organization had no AI access controls in place.

Read More

A few years ago, I was pulled into an incident that started with a single customer call. The customer had logged into the platform that morning and noticed files were missing. At first, everyone assumed it was a support issue. Then a second customer reported something similar. Then a third. Within an hour, leadership was pulled into the conversation. At that point, nobody knew whether the issue was operational, accidental, or security related. The investigation was just getting started.

Read More

Every organization worries about a breach. Almost none understand what one actually looks like until they live through it. This is the first post in a series on what actually happens before, during, and after a breach. This one is about what comes before: the conditions that were already there, long before anyone knew there was a problem.Every organization worries about a breach. Almost none understand what one actually looks like until they live through it.

Read More

Security is not one size fits all. A 10-person startup with an MVP and a short runway should not be investing like a 5,000-person global SaaS company preparing for IPO. But too often, companies either underinvest early or throw money at tools without a plan later.

Read More

Most cyberattacks do not start with elite hackers or advanced exploits. They start with simple gaps. A stolen password. A phishing email. A forgotten backup. For many organizations, the biggest threats are ransomware, email compromise, and credential theft. The damage can be significant.

Read More

Cyber insurance used to be a checkbox. Today, it is a battleground. Carriers have tightened their requirements, premiums are on the rise, and coverage exclusions are more aggressive than ever. Many companies find themselves unprepared, with no clear roadmap on how to qualify or reduce their costs.

Read More