AI Has Changed Attack Speed, Not Security Fundamentals

Sick of hearing about virtual patching? Feel like it's nothing new? Join the club - I discuss in my latest SecurityWeek piece: https://www.securityweek.com/ai-has-changed-attack-speed-not-security-fundamentals/.

Rethinking Application Security for the AI Era

As AI dramatically shortens the time from vulnerability disclosure to exploitation, has the time come to rethink application security? I discuss in my latest SecurityWeek piece: https://www.securityweek.com/rethinking-application-security-for-the-ai-era/.

Frontier AI: Six Questions Every Enterprise Should Ask Security Vendors

With so many vendors talking about Frontier AI, how can enterprise security teams separate genuine capabilities from marketing hype? I discuss in my latest SecurityWeek piece: https://www.securityweek.com/frontier-ai-six-questions-every-enterprise-should-ask-security-vendors/.

After AI Reaches Production: 12 Ways Security Teams Can Take Control

Security teams need more than visibility into AI applications, they need a repeatable framework for monitoring, investigating, and defending them in production. I discuss in my latest SecurityWeek piece: https://www.securityweek.com/after-ai-reaches-production-12-ways-security-teams-can-take-control/.

Caught Off Guard: Securing AI After It Hits Production

As enterprises rush AI projects into production, security teams are increasingly being forced into reactive mode. How can security teams prepare for this to minimize the impact of being blindsided? I discuss in my latest SecurityWeek piece: https://www.securityweek.com/caught-off-guard-securing-ai-after-it-hits-production/.

The Hidden ROI of Visibility: Better Decisions, Better Behavior, Better Security

Beyond monitoring and compliance, visibility acts as a powerful deterrent, shaping user behavior, improving collaboration, and enabling more accurate, data-driven security decisions. I discuss in my latest SecurityWeek piece: https://www.securityweek.com/the-hidden-roi-of-visibility-better-decisions-better-behavior-better-security/.

The Human IOC: Why Security Professionals Struggle with Social Vetting

In the security field, we focus so much on vetting data and information. Yet, when it comes to people or organizations, we invest far less in vetting them. Why is that and how can we improve? I discuss in my latest SecurityWeek piece: https://www.securityweek.com/the-human-ioc-why-security-professionals-struggle-with-social-vetting/.

Security in the Dark: Recognizing the Signs of Hidden Information

Security in the Dark: Recognizing the Signs of Hidden Information - My latest piece in SecurityWeek discusses that security failures don’t always start with attackers, sometimes they start with missing truth. https://www.securityweek.com/security-in-the-dark-recognizing-the-signs-of-hidden-information/.

The Loudest Voices in Security Often Have the Least to Lose

Beware of security advice that comes from people or organizations that have no stake in the outcome, nothing to lose, and won't bear any of the consequences. What do I mean? I discuss in my latest SecurityWeek piece: https://www.securityweek.com/the-loudest-voices-in-security-often-have-the-least-to-lose/.

The Great Disconnect: Unmasking the ‘Two Separate Conversations’ in Security

Have you ever observed two people talking to one another, yet having two entirely different conversations? I discuss how this can harm security in my latest SecurityWeek piece: https://www.securityweek.com/the-great-disconnect-unmasking-the-two-separate-conversations-in-security/.

What Makes a Great Field CXO: Lessons from the Front Lines

What makes a great Field CXO? I discuss in my latest SecurityWeek piece: https://www.securityweek.com/what-makes-a-great-field-cxo-lessons-from-the-front-lines/.

Perspective: Why Politics in the Workplace is a Cybersecurity Risk

Have you stopped to consider how bringing politics into the workplace is a security risk? I discuss in my latest SecurityWeek piece: https://www.securityweek.com/perspective-why-politics-in-the-workplace-is-a-cybersecurity-risk/.

Slow and Steady Security: Lessons from the Tortoise and the Hare

What can Aesop’s fable “The Tortoise and the Hare” teach us about security? A lot I would argue, particularly about ignoring hype and building security programs that are consistent, resilient, and effective. I discuss in my latest SecurityWeek piece: https://www.securityweek.com/slow-and-steady-security-lessons-from-the-tortoise-and-the-hare/.

Reclaiming Control: How Enterprises Can Fix Broken Security Operations

Remember when those of us working in security operations had a fighting chance to successfully defend the enterprise? I do. Overly complex modern infrastructures have taken much of this ability away. I share some thoughts on how security teams can take it back in my latest SecurityWeek piece: https://www.securityweek.com/reclaiming-control-how-enterprises-can-fix-broken-security-operations/.

Why Sincerity Is a Strategic Asset in Cybersecurity

Strong security doesn’t just rely on tools — it starts with trust, clarity, and sincerity from the top down. I discuss why sincerity is a strategic asset in security in my latest SecurityWeek piece: https://www.securityweek.com/why-sincerity-is-a-strategic-asset-in-cybersecurity/.

Rethinking Success in Security: Why Climbing the Corporate Ladder Isn’t Always the Goal

Rethinking Success in Security: Why Climbing the Corporate Ladder Isn’t Always the Goal. In my latest SecurityWeek piece, I discuss what I believe is an important topic regarding careers in the security field: https://www.securityweek.com/rethinking-success-in-security-why-climbing-the-corporate-ladder-isnt-always-the-goal/.

Actions Over Words: Career Lessons for the Security Professional

In a world full of noise and promises, it’s those who consistently deliver behind the scenes who build the most respected and rewarding careers. I'd advise prioritizing doing over talking. I discuss in my latest SecurityWeek piece: https://www.securityweek.com/actions-over-words-career-lessons-for-the-security-professional/.

Groucho’s Wit, Cloud Complexity, and the Case for Consistent Security Policy

Groucho’s Wit, Cloud Complexity, and the Case for Consistent Security Policy: In my latest SecurityWeek piece, I discuss how Grouch Marx's humor can teach us an important lesson around the importance of applying consistent security policy. https://www.securityweek.com/grouchos-wit-cloud-complexity-and-the-case-for-consistent-security-policy/

Through the Lens of Music: What Cybersecurity Can Learn From Joni Mitchell

What can Joni Mitchell teach us about cloud security? Perhaps more than you might initially think. I discuss in my latest SecurityWeek piece: https://www.securityweek.com/through-the-lens-of-music-what-cybersecurity-can-learn-from-joni-mitchell/.

The Hidden Cost of Compliance: When Regulations Weaken Security

Can regulations actually weaken security? I would argue that they can. I explain why in my latest SecurityWeek piece: https://www.securityweek.com/the-hidden-cost-of-compliance-when-regulations-weaken-security/. Food for thought and a discussion that I believe is long overdue.