People ask me all the time: “Evan, what’s the single most important thing I can do to protect myself and my organization?” They expect me to say MFA, patch your systems, buy the latest shiny tool, or maybe hire a great vCISO. Nope. My answer is always the same, it

For most of us, ransomware stories feel abstract — something that happens to “other companies,” something insurance will cover, something you can recover from with backups and a good IT team. Then came the collapse of KNP Logistics Group, better known under its flagship brand Knights of Old. A 158-year-old

If you know me, you know I love a good rabbit hole. I’ll start researching one thing — maybe a vulnerability, a business idea, some random historical footnote — and three hours later I’m neck-deep in technical docs, case studies, or a string of “how did I end up here?”

NOTE: This came from an internal dialog with myself. So, when you see “you”, think of me referring to myself. Lord knows, I am a work in progress and I may not be qualified to give you (the one reading this) advice. We love our freedom of speech. It’s one

Security is long-term. Most leadership is not. This is the sixth and final part of the Accountability in Cybersecurity is Broken series, exploring the root causes behind why accountability is critical to our mutual success and why it’s fundamentally broken. If you’ve been following along (Part 1, Part 2, Part

Confusion sells. Simplicity doesn’t. And that’s no accident—it’s a damn business model. IMPORTANT RANT ALERT – This post calls out vendors, “experts”, and so-called professionals. It’s VERY important to note, that many vendors, experts, and professionals in our industry are good (“good” is subjective, of course). Here, I’m calling out