I’m a cybersecurity strategist with 17+ years of experience helping large organizations design and mature security programs rooted in data, process, and resilience.
Suppose an organization purchases an AI assistant to help employees understand company policies. The AI supplier provides the application, and the context (e.g., policies) already exists in customer policy repositories in various locations. The service architecture...
At BSides Greenville last weekend, I had a great conversation with a colleague about the difficulty of detecting new skills, plugins, and context being deployed by non-privileged users in our clients' environments. Traditional web-filtering or cloud-security tools can...
AI system drift presents a communication challenge between CISOs and their stakeholders. Enterprise colleagues are bound to ask, "If you're so sure that this AI-powered SaaS solution doesn't use or store any of our data, how does drift occur between vendor releases?"...
For years, cybersecurity has struggled with measuring performance, risk, and return on investment. Security teams built dashboards, defined KPIs, and attempted to quantify risks, often with increasing levels of sophistication. Yet many of these efforts ultimately...
Summary: Much of the current discourse about artificial intelligence hinges on whether it qualifies as a “disruptive innovation,” a term coined by Clay Christensen in the 1990s to explain why large firms lose their edge to unexpected competitors. But for IT and...
I'm almost halfway done with the pre-requisites for my PhD. It feels good to be making headway. I created a word cloud of all the papers I've reviewed so far in order to see if any themes emerged. I was surprised to see the theme of 'big data' be so much more...
This post serves to gather some of the discussion points, questions, and further resources regarding the topic of cyber insurance discussed at the 2023 Planet Cyber Security Conference in San Diego 12/06/2023. Bottom Line Up Front: The majority of the group felt that...
Vendor security questionnaires were always discussed with an eye roll when I started in this field in 2008. We assigned an analyst to address the concerns of our partners. We also assigned a security architect to send our security questionnaires to our growing list of...
Scenario Planning (SP) exercises can differ depending on the industry and managerial level. Strategic leadership, information system leadership, and academia all view SP differently. Before understanding SP, we need to wade through the sometimes-confusing terms of...