Security is long-term. Most leadership is not. This is the sixth and final part of the Accountability in Cybersecurity is Broken series, exploring the root causes behind why accountability is critical to our mutual success and why it’s fundamentally broken. If you’ve been following along (Part 1, Part 2, Part

Confusion sells. Simplicity doesn’t. And that’s no accident—it’s a damn business model. IMPORTANT RANT ALERT – This post calls out vendors, “experts”, and so-called professionals. It’s VERY important to note, that many vendors, experts, and professionals in our industry are good (“good” is subjective, of course). Here, I’m calling out

Part 4 of the “Accountability in Cybersecurity is Broken” Series NOTE: Let me preface this by stating that I am not a lawyer, nor am I qualified to give you legal advice. I am a 30+ year information security veteran who’s tired of seeing people get screwed over by a

Part 3 of the “Accountability in Cybersecurity is Broken” Series The Day I Learned the Truth The first time I realized politics was a dirty business was in 1998. Our U.S. Representative came to visit our workplace. At one point, he asked us: “What do you think my #1 priority

It’s Not Real Until It Hurts: Why No One Demands Change If nobody is going to hold you accountable, why be accountable? Believe it or not, some people will claim that we’ve made progress in cybersecurity. Sure, there are more tools, more frameworks, more professionals, and more funding than ever—but

Let’s not waste time. Yes, accountability in cybersecurity is broken. Badly. In fact, it’s been broken for a long time. We talk a big game in this industry about “responsibility” and “doing the right thing,” but when something goes wrong–when someone gets hurt, when data is stolen, when systems fail–who’s