Insights & Essays
Writing on Business Survivability, Integrated Assurance, Decision Debt, Operational Trust, AI, cyber risk and the decisions that shape how organizations respond to change and disruption.
85 articles, newest first
AI & Organizational Risk
Most organizations are spending a lot of time trying to figure out how they want to use AI. They are developing policies, deciding which tools employees can use, looking at privacy concerns and trying to determine where AI makes sense in…
Read articleDecision Debt
For years, technology leaders have used the term technical debt to describe the future cost created when a business chooses the fastest solution instead of the best long-term one. A rushed software release, an aging platform, or an…
Read articleCyber Risk & Insurance
Cyber insurance applications have changed quite a bit. What used to be a fairly straightforward questionnaire about firewalls, antivirus, and a few basic security practices has become a much closer look at how a business actually manages…
Read articleBusiness Survivability
Cybersecurity, Cyber Insurance and Business Survivability for Nonprofits
Read articleBusiness Survivability
A lot of companies have cyber insurance. The problem is that many of them may not actually know whether the coverage they bought has much relationship to the loss they could experience.
Read articleCyber Risk & Insurance
For years, the cyber insurance conversation has been heavily focused on security controls. Do you have MFA? Are you using EDR? Are your backups protected? Are you patching vulnerabilities? Those questions made sense because insurers were…
Read articleCyber Risk & Insurance
Small businesses have always been difficult to bring into the cyber insurance market. Cost gets much of the blame, along with complexity and the lingering belief among some smaller companies that cyber insurance simply isn’t something they…
Read articleBusiness Survivability
The cyber insurance market has changed considerably over the past few years. Pricing has softened, capacity has returned, and insurers have gotten much better at understanding the risks they’re underwriting. Businesses have also responded…
Read articleAI & Organizational Risk
The challenge of understanding a growing business is not new. Organizations have been adapting to changing markets, new technologies, and evolving customer expectations for decades. What is new is the speed at which those changes are now…
Read articleLeadership & Governance
Most businesses spend years optimizing for efficiency and very little time understanding how they would operate if that efficiency suddenly disappeared. That is not a criticism. It is simply the result of success. When systems are…
Read articleLeadership & Governance
One of the advantages of leading a growing business is that experience builds confidence. Leaders learn where to focus their attention, employees become more efficient, and many of the day-to-day decisions that once required careful…
Read articleLeadership & Governance
People often talk about complexity as though it arrives with size. Reach a certain number of employees, open another location, acquire another company, and complexity simply appears. My experience has been very different. Complexity has…
Read articleCyber Risk & Insurance
Most business owners spend considerable time hiring the right employees. They interview candidates, check references, verify experience, and think carefully about whether someone can be trusted with customers, finances, or day-to-day…
Read articleLeadership & Governance
Every business owner wants growth. It is the reason people accept the uncertainty that comes with building a company in the first place. Growth brings new customers, larger opportunities, stronger cash flow, and the ability to invest in…
Read articleAI & Organizational Risk
One of the greatest advantages of owning a business is that you understand almost everything that happens inside it. In the early days, nothing escapes your attention for very long. You know which customers pay on time and which ones need…
Read articleCyber Risk & Insurance
Most cybersecurity conversations begin in the wrong place. The discussion usually starts with threats, vulnerabilities, controls, or the latest technology designed to stop an attack. Those topics matter, but they often distract leaders…
Read articleCyber Risk & Insurance
Cyber insurance was something organizations thought about once a year. The renewal would come around, someone would fill out the application, a few questions would get routed to security, finance would review the cost, and the policy would…
Read articleAI & Organizational Risk
Every generation gets its own technology revolution. The internet changed how we access information. Cloud computing changed how businesses consume technology. Artificial intelligence is changing how work gets done. Most of the discussion…
Read articleLeadership & Governance
Every executive eventually asks some version of the same question. Sometimes it is about cybersecurity. Sometimes it is about financial controls, operational risk, compliance, or business continuity. The wording changes, but the intent is…
Read articleCyber Risk & Insurance
Most small and mid-sized business owners think about cyber risk in terms of hackers. They worry about ransomware, stolen passwords, fraudulent payments, and data breaches. Those concerns are real, but they are not the only source of risk…
Read articleAI & Organizational Risk
Most discussions about AI focus on what the technology can do. The conversation usually revolves around productivity gains, automation, efficiency, and innovation. Those benefits are real, but they miss the larger story. What makes AI…
Read articleCyber Risk & Insurance
I have been seeing an onslaught of Mythos posts, blogs, and articles everywhere, and depending on who is talking about it, the message usually swings between two extremes. Either it gets framed like a revolutionary breakthrough that…
Read articleCyber Risk & Insurance
I’ve been asked numerous times whether insurers are actually better at quantifying cyber risk than CISOs. I get why the question keeps coming up, since I write about how insurers are shaping the cybersecurity landscape. But here's the…
Read articleCyber Risk & Insurance
Most brokers didn’t grow up selling cyber. It showed up fast, got complicated even faster, and now it sits right in the middle of client conversations whether you want it there or not. Some clients ask for it directly. Others don’t bring…
Read articleCyber Risk & Insurance
Most cyber insurance conversations still start with the claim. How it’s filed. How it’s measured. How it’s paid. All of that matters, sure. But it misses the part that actually determines whether a business makes it through an incident or…
Read articleCyber Risk & Insurance
Most retailers deal with the same constraints that most mid-sized businesses face. Technologies change and evolve. Parts of the environment had been migrated to the cloud, while other parts had not. This retailer was not ignoring security.…
Read articleCyber Risk & Insurance
Most small and mid-sized businesses don’t think they have a control problem. On paper, things usually look fine. Security tools are in place, policies exist, and requirements are technically met, but that’s rarely where things break. The…
Read articleAI & Organizational Risk
Artificial intelligence is starting to show up in cyber insurance conversations in a way most businesses aren’t fully prepared for. Not as a strategy discussion or a question of productivity, but as a new layer of risk that insurers are…
Read articleCyber Risk & Insurance
Most denials of cyber insurance come down to one underlying issue. The risk of being compromised is either too great, or it cannot be measured with enough confidence to be priced. That is the starting point. It is not about whether a…
Read articleCyber Risk & Insurance
Insurability changes the risk management conversation in ways most organizations do not fully appreciate until they experience it. For years, risk has been framed through internal lenses such as frameworks, control coverage, and maturity…
Read articleLeadership & Governance
On paper, many organizations appear disciplined in how they manage risk. Policies are documented and version controlled. Frameworks are mapped and cross-referenced. Governance committees meet regularly. Dashboards display risk indicators…
Read articleCyber Risk & Insurance
There was a time when cyber insurance felt comfortably distant from day-to-day security operations. It was positioned as a financial instrument, a transfer mechanism that sat downstream from prevention and response. The annual ritual was…
Read articleCyber Risk & Insurance
It is useful, from time to time, to slow down and trace the anatomy of a single incident. Not the headline version, but the lived version.
Read articleCyber Risk & Insurance
For a long time, organizations believed they had risk management reasonably contained. The risk management lifecycle that most enterprises still reference was built for a different era. Identify, protect, detect, respond, recover remains…
Read articleAI & Organizational Risk
“AI SOC” is everywhere right now, so it must be table stakes right... And when something becomes table stakes… it stops being differentiation. The uncomfortable truth is that investigation automation was never the breakthrough. So what's…
Read articleAI & Organizational Risk
When I first began building and deploying security information and event management (SIEM) platforms at scale, the objective was to gain visibility. Logs were scattered across infrastructure, investigations required logging into individual…
Read articleIntegrated Assurance
I am excited to share that my latest book Relevant Impact: A Field Guide to Integrated Assurance is off to my publisher Taylor & Francis Group for release in spring of 2026 as part of the CRC Press Security, Audit and Leadership series. I…
Read articleAI & Organizational Risk
This week I had the opportunity to review and provide feedback to National Institute of Standards and Technology (NIST) on NIST IR 8596 irpd: Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile).
Read articleAI & Organizational Risk
The recent article by CRN CrowdStrike CEO: Endpoint Security Re-Accelerates As AI Surge Leads To ‘Renewed Interest’ presents a familiar storyline. A surge in the use of AI clients and AI enhanced browsers is described as a new form of…
Read articleAI & Organizational Risk
Cybersecurity has always reminded me of the early days of heavy metal. It began with a small community of committed practitioners who valued grit and authenticity. It was loud, rough and shaped by people who treated the work like a craft.…
Read articleAI & Organizational Risk
I’ve been speaking a great deal on AI and the cybersecurity impacts that come from the rapid adoption. In my talks I’ll often welcome folks to the Heavy Metal portion of the conference I’m speaking at. Why? Because like metal, the early…
Read articleLeadership & Governance
Nice to see my article, The New vCISO Mandate, hit the cover of the December edition of Cyber Defense Magazine .
Read articleIntegrated Assurance
The broadcast industry’s security model has historically been fragmented, divided along the same operational boundaries that once defined its organizational structure. Engineering managed transmission integrity, IT managed network…
Read articleAI & Organizational Risk
Artificial intelligence has not only transformed broadcasting but also redefined how threats manifest and evolve within it. The broadcast kill chain, once linear and dependent on human initiative, now includes autonomous agents capable of…
Read articleCyber Risk & Insurance
Broadcasting has undergone a transformation more profound than any in its century-long history. Once governed by closed transmission networks and controlled production pipelines, the modern broadcast enterprise now operates as an…
Read articleAI & Organizational Risk
Broadcasting is no longer defined by storytelling alone. It has become a discipline of signal integrity, digital trust, and operational assurance. In an environment where artificial intelligence and autonomous threats continuously reshape…
Read articleAI & Organizational Risk
When Anthropic released its report Disrupting the first reported AI-orchestrated cyber espionage campaign , many readers reacted with surprise. I did not. The findings match the trajectory I have been writing about for months. Agentic AI…
Read articleAI & Organizational Risk
Enterprises often adopt artificial intelligence in isolated projects or experimental pilots. These initiatives may show promise but rarely come with the governance, oversight, or cultural accountability needed to sustain trust. The…
Read articleIntegrated Assurance
AI cannot be managed by traditional security or compliance models alone. Its behavior shifts with data, its risks appear across the entire lifecycle, and its outcomes influence stakeholders far beyond IT. To govern AI effectively…
Read articleCyber Risk & Insurance
I regularly meet bright, motivated students who want to work in cybersecurity. They talk about joining a Security Operations Center, chasing alerts, and catching hackers. It sounds exciting. It feels like the heart of the action. But I…
Read articleAI & Organizational Risk
AI has broadened the scope of enterprise vulnerability. What once required specialized skills, time, and resources can now be automated, scaled, and customized by models that learn from the very systems they target. The enterprise…
Read articleAI & Organizational Risk
Artificial intelligence is being woven into the very fabric of enterprise operations. It informs how organizations interact with customers, automate decisions, and shape strategies for growth. Yet with every deployment, a new layer of risk…
Read articleAI & Organizational Risk
For years, companies have relied on risk assessments that capture a moment in time. A team reviews controls, auditors check compliance, and a report is delivered. Leaders read the findings, accept the conclusion, and assume stability until…
Read articleIntegrated Assurance
When I set out to write Integrated Assurance: Unified Risk Strategy , I imagined the finish line would be the day I held a printed copy in my hands. I thought of publishing as an endpoint. What I didn’t expect was how much the journey to…
Read articleIntegrated Assurance
The Integrated Assurance Maturity Model (IAMM) does not exist in a vacuum. It was not designed to replace existing frameworks or to compete with them for organizational attention. Instead, IAMM complements established models by providing…
Read articleIntegrated Assurance
Adopting the Integrated Assurance Maturity Model (IAMM) is not a single project, nor is it an initiative that can be completed within a fixed timeframe. It is a transformation that requires leadership vision, organizational alignment, and…
Read articleLeadership & Governance
Culture and collaboration are the most human elements of assurance. Technology can enforce controls, governance can define priorities, and operations can embed resilience, but without the right culture and collaborative behaviors, these…
Read articleLeadership & Governance
Metrics and reporting are often treated as the end stage of assurance and the outputs that executives and boards review to measure performance. In reality, they are much more than that. They are the mechanisms that drive accountability…
Read articleIntegrated Assurance
Risk, compliance, and audit have long been the pillars of enterprise oversight, providing mechanisms to identify, assess, and manage risk while ensuring adherence to standards and validating control effectiveness. However, in many…
Read articleIntegrated Assurance
IT and operations form the heartbeat of the enterprise, responsible for keeping systems available, ensuring services are delivered, and maintaining the infrastructure that supports every business function. When these functions operate…
Read articleLeadership & Governance
Architecture and engineering represent the critical convergence point where vision meets execution in enterprise assurance. While governance defines principles and direction, this domain determines how those principles are embedded into…
Read articleIntegrated Assurance
Governance is the foundation of integrated assurance because it establishes the structures, forums, and decision-making frameworks that guide organizational direction. Without governance, assurance activities remain isolated, lacking…
Read articleIntegrated Assurance
Organizations exist within ecosystems shaped by interconnected digital platforms, third-party dependencies, regulatory demands, and rapidly shifting market conditions. In this environment, risk does not present itself in isolated events…
Read articleIntegrated Assurance
Organizations are deploying AI models across public cloud, private data centers, and edge environments at unprecedented speed. The 451 Research report “Securing AI at Scale” captures this moment clearly. Executives recognize that security…
Read articleIntegrated Assurance
Organizations are faced with the fact that risk is everywhere, but governance, IT, and security still work in silos. Traditional frameworks such as NIST, COBIT, ISO, SABSA, COSO, ESRM and others help, but they were never designed to unify…
Read articleAI & Organizational Risk
Every cyberattack ultimately converges on an outcome of extracting value or inflicting damage. In the MITRE ATT&CK framework, these phases are captured in Exfiltration and Impact. They represent the endgame, the moment when an adversary…
Read articleAI & Organizational Risk
When adversaries breach an enterprise, they must maintain communication with their tools and agents inside the environment. This is where command and control becomes the most critical stage of the attack lifecycle. It allows attackers to…
Read articleAI & Organizational Risk
Once an adversary establishes a foothold inside an organization, the real campaign begins. Initial access is rarely the end goal. Attackers want more. They want privileged accounts, sensitive data, and pathways into critical systems. To…
Read articleAI & Organizational Risk
Every successful attack depends on reconnaissance. In the physical world, a burglar studies a neighborhood before choosing which house to break into. In the digital world, attackers perform discovery. Once inside a network, they want to…
Read articleAI & Organizational Risk
Every enterprise leader knows that credentials are the crown jewels of modern business operations. Usernames, passwords, API keys, certificates, and tokens are the digital keys that unlock sensitive data and critical systems. When…
Read articleAI & Organizational Risk
Cyber defense has always been a race between visibility and concealment. Security teams deploy monitoring systems, intrusion detection, and behavioral analytics to expose threats. Attackers counter by hiding their activity, blending into…
Read articleIntegrated Assurance
AI is now embedded into decision making, customer interactions, and operational workflows. With this integration comes risk. Enterprises need a way to measure, govern, and secure AI across its lifecycle while also understanding their…
Read articleAI & Organizational Risk
AWS recently published their Prescriptive Guidance on Building AI Agents . It is a strong document if you are an architect or developer trying to understand frameworks, protocols, and tools. It shows how to stitch together LangChain…
Read articleAI & Organizational Risk
Every intrusion begins small. An attacker may enter with a low-level user account, a compromised API key, or access to a single endpoint. But the real prize is not the first foothold. It is the ability to escalate privileges and gain…
Read articleAI & Organizational Risk
Stopping an attacker at the moment of intrusion is always ideal, but defenders know it rarely happens that cleanly. Once an adversary gains entry, their next priority is persistence. In the MITRE ATT&CK framework, persistence describes the…
Read articleAI & Organizational Risk
Gaining access is only the beginning. The real turning point in any attack comes when an adversary begins to execute code, run commands, and manipulate systems. In the MITRE ATT&CK framework, this is known as Execution. Traditionally, this…
Read articleAI & Organizational Risk
Every adversary needs a way in. In the MITRE ATT&CK framework, this stage is known as Initial Access. Traditionally, attackers might rely on one primary vector, such as phishing or exploiting a vulnerable web application. Once that door…
Read articleAI & Organizational Risk
Every attack requires resources. Domains must be registered, servers provisioned, accounts created, and tools prepared. In traditional operations, this stage was a clear and time-bound activity. Attackers would set up infrastructure…
Read articleAI & Organizational Risk
Every cyber intrusion begins with reconnaissance. Traditionally, this has been the stage where attackers gather intelligence before launching their first real move. Human operators would scan networks, collect open-source intelligence, and…
Read articleAI & Organizational Risk
The State of AI in Business 2025 Report by MIT shows how deeply AI is being adopted across industries. Customer engagement, decision automation, predictive analytics, and operational efficiency are all being driven forward by intelligent…
Read articleAI & Organizational Risk
For years, cybersecurity leaders have prepared for automation in attack campaigns. We have seen scripts, botnets, and malware families evolve into complex, semi-automated threats. What we are now facing with Agentic AI is a different order…
Read articleAI & Organizational Risk
With the widespread deployment of generative and agentic AI systems across industries, the risks they introduce have become immediate, material, and in many cases, poorly understood. Two recent works frame the challenge from different but…
Read articleIntegrated Assurance
AI has shifted from being a promising technology to a foundational capability shaping enterprise decisions, products, and services. With that shift comes an urgent need for assurance models that protect both the integrity of AI systems and…
Read articleAI & Organizational Risk
The transition of Artificial Intelligence (AI) from experimental pilots to essential business infrastructure occurred at an unprecedented pace. AI technology operates within systems which handle loan approvals and supply chain adjustments…
Read articleAI & Organizational Risk
Organizations have invested multiple years into developing incident response (IR) plans. They possess established methods to deal with malware outbreaks as well as phishing campaigns and data breaches. The implementation of artificial…
Read article