Home

Blog

Security Leadership Insights

Frameworks, strategy, and the human side of security leadership.

Get new posts in your inbox

Frameworks and frontline lessons for security leaders. No spam, unsubscribe anytime.

Frameworks for Security Leaders

SaaS is Dead. Long Live SaaS.

AI collapsed the software moat in eighteen months. What survives is trust: brilliance in the basics, real customer choice, and transparency you can verify.

10 min read
Read
Frameworks for Security Leaders

Security Theater

A good security program creates easy certification. A good certification program creates breaches. Why building to the certificate leaves nothing underneath.

7 min read
Read
Leadership Reflections

Why Optimism Is the Better Tactic

A PayPal CEO cut off my fifteen-minute list of everything that was wrong: 'What are you doing about it?' Why optimism is the better tactic, not the softer one.

6 min read
Read
Frameworks for Security Leaders

You Never Get Money from the Board

A peer CISO sent me his board deck for feedback. The eighth slide had the ask. I told him it would not get him the money: the slides aimed at the wrong room.

7 min read
Read
Frameworks for Security Leaders

Security Is the Downforce

My old boss had a formula: security equals one over productivity. I believed it for years, but not anymore. The job is to build a car that takes the corners.

9 min read
Read
Leadership Reflections

The Closet Floor

Midnight before Black Friday at PayPal. I'm on the closet floor holding calls so the house stays asleep. The visible work is the slide. The actual work is this.

11 min read
Read
Leadership Reflections

The Shoulder, the Agent, and the Job

A torn rotator cuff, ninety minutes of insomnia, and Claude Code. What a CSO's pre-dawn build session taught me about product thinking in security today.

7 min read
Read
Leadership Reflections

The Three-Day Draft

In 2020 I drafted a Slack message disclosing my PTSD and held it for three days. For Mental Health Awareness Month, what sending it taught me about silence.

6 min read
Read
AI & Emerging Threats

The Attack Surface Diet: Lessons from Remission

A phrase from David Moulton on Threat Vector named what AI is doing to security programs. Four moves to shed weight, build muscle, and keep the program lean.

9 min read
Read
AI & Emerging Threats

We Didn't Start the Fire. We Have to Put It Out.

The AI security inflection point arrived in 2023, not last week. Organizations still treating this as a future problem are running out of time to change course.

8 min read
Read
Leadership Reflections

Familiarity Is Not Knowledge

Even a little familiarity is enough to stop you from really looking. In security, that's not just a personal liability, it's a structural one.

7 min read
Read
Security Leadership

The Workforce Problem Nobody at RSA Wanted to Talk About

AI agents are taking over the entry-level work that built our careers. If we do not act now, we are building a 10-year workforce crisis we will regret.

9 min read
Read
Security Leadership

Trust Is the New Baseline

Two conferences, two different worlds, but the same word kept coming up: trust. The CX and security communities are having conversations that need to converge.

8 min read
Read
AI & Emerging Threats

AI Isn't the Threat. Your Reaction Is.

Half of employees use AI regularly, and 80% mix in tools IT never approved. Adversaries already use AI to scale attacks. Is your team keeping pace?

11 min read
Read
Frameworks for Security Leaders

The Security Investment Playbook, Part 2: Kill Your Science Experiments

Security teams run science experiments all the time, and it is one of the biggest drains on our effectiveness. Here is how to spot them and what to do instead.

9 min read
Read
Frameworks for Security Leaders

The Security Investment Playbook, Part 1: Core, Context, Commodity

The Core, Context, Commodity framework is the single most useful lens for deciding where your security team should spend its energy.

8 min read
Read