Type 1 or Type 2? The SOC 2 Decision Nobody Explains Properly
Founders ask me this early, usually right after a prospect’s procurement team sends over a security/vendor review questionnaire.
Writing
Field notes from building the function.
Practical lessons on security leadership, risk, compliance, and AI. Written from the work, for the people doing it.
AI Writes Fast. Compliance Moves Slow. Somebody Has to Own the Gap.
AI has made writing code faster than it’s ever been. Pull requests that used to take a day now take an hour.
Breaking AI Agents: What a Vendor Chatbot Told Me It Shouldn’t Have - Part 01: Recon
Welcome to a new thread. Over the last few years I’ve written about the DevOps, DevSecOps, Security and Compliance based on my everyday experience.
By the Time Startups Take Security Seriously, They Are Already Years Behind
Security debt does not announce itself. It does not show up on a dashboard. It does not trigger an alert.
Hiring a Security Person Does Not Fix Your Security Problem
Every company I worked at made the same mistake. They hired someone for security, exhaled, and moved on.
Most Security Roadmaps Fail Because They Don’t Prioritize Risk Correctly
Why activity-driven security programs produce effort without meaningful risk reduction.
Security Is Not a Cost Center. It’s a Risk Transfer Function.
Why CISOs, CTOs, CEOs, and CFOs need to evaluate security in terms of financial exposure, not just controls.
Most Startups Are Not Prepared for a Security Incident. Even If They Think They Are.
Why detection and response maturity define enterprise readiness more than any compliance framework. I’ve had versions of the same conversation many times.
How to Pass a Fortune 500 Security Review Without a Security Team
A simple framework to assess whether your security posture will pass real-world scrutiny. Enterprise security reviews feel complicated from the outside.
Security Isn’t a Knowledge Problem. It’s a Prioritization Problem.
Security doesn’t fail because teams don’t care. It fails because they’re optimizing for something else.