You’ve heard it in every boardroom, read it in every “State of the Industry” report, and seen it plastered across LinkedIn by people who haven’t managed a real incident in a decade. “It’s industry best practice.” It sounds safe. It sounds authoritative. It sounds like a shortcut to security. In reality, it’s usually just a fancy way of saying: “We’re doing exactly what everyone else…
In 2022, I sat in a meeting where three companies were pitching vCISO services to a consortium of 26 organizations. The question was simple: “Tell us how your vCISO services work.” The first company — a consulting firm from the east coast — answered: “Well, we sell you a block of hours, and as you need services performed, we deduct from your hours.” The second…
I’ve spent more than 30 years in information security, and here’s a truth that still makes people uncomfortable: Information security isn’t really about information or security. It’s about people. But not just one kind of people. Every security incident—every breach, outage, or “technical failure”—involves three distinct groups of people, whether we acknowledge it or not: The people who make decisions — those who design systems,…
Every Christmas, people talk about peace, joy, giving, gratitude… all the good stuff. Meanwhile, the criminals are rubbing their hands together like it’s their holiday. Because for them? It is. The truth is simple and uncomfortable: The holiday season is the Super Bowl for scammers, thieves, and every flavor of dirtbag who preys on distraction, kindness, stress, and chaos. Every year, too many good people…
People ask me all the time: “Evan, what’s the single most important thing I can do to protect myself and my organization?” They expect me to say MFA, patch your systems, buy the latest shiny tool, or maybe hire a great vCISO. Nope. My answer is always the same, it never changes: Learn, embrace, and master situational awareness. Everything else evolves from there. What I…
For most of us, ransomware stories feel abstract — something that happens to “other companies,” something insurance will cover, something you can recover from with backups and a good IT team. Then came the collapse of KNP Logistics Group, better known under its flagship brand Knights of Old. A 158-year-old British haulage company — hundreds of trucks, hundreds of employees, generations of history — was…
It’s Not Real Until It Hurts: Why No One Demands Change If nobody is going to hold you accountable, why be accountable? Believe it or not, some people will claim that we’ve made progress in cybersecurity. Sure, there are more tools, more frameworks, more professionals, and more funding than ever—but let’s be honest. When you zoom out and look at the full picture, we haven’t…
Let’s not waste time. Yes, accountability in cybersecurity is broken. Badly. In fact, it’s been broken for a long time. We talk a big game in this industry about “responsibility” and “doing the right thing,” but when something goes wrong–when someone gets hurt, when data is stolen, when systems fail–who’s actually held accountable? Rarely the people who should. And that’s the problem. Responsibility ≠ Accountability…
There’s a big difference between data and information, and frankly, not enough people get it. In cybersecurity–and life–that misunderstanding isn’t just annoying. It’s dangerous. Here’s the short version: Data is raw. It’s messy, unfiltered, and full of potential. Information is processed. It’s someone else’s version of the story. And given the choice, I’ll take the data. Every single time. The Problem With “Information” When someone…
Some nights I sit back, sip my coffee (or whatever’s strong enough to keep me from flipping tables), and let the question roll around in my head like it owns the place: Does any of this actually matter? I’ve been in this game long enough to know how the sausage is made. Security programs built on duct tape and prayers. Execs who think “acceptable risk”…