Hacker Summer Camp wrapped up last week. Black Hat USA 2026 ran August 1-6 at Mandalay Bay, DEF CON 34 followed August 6-9 at the Las Vegas Convention Center, and somewhere north of 50,000 security professionals spent the better part of two weeks in 105-degree heat talking about the things that are going to show…
The 4th of July just wrapped up. Somewhere between the cookout and the fireworks show, your organization ran on skeleton crew coverage, half your security team was on PTO, and a meaningful chunk of your workforce was connecting from personal devices on home networks, hotel Wi-Fi, or wherever the holiday took them. That’s not a…
Six months in. It’s a reasonable moment to step back from the tactical and look at the rest of the year as a whole — what’s coming, what’s already behind schedule, and where security and GRC programs need to be positioned heading into Q3 and Q4. This isn’t a predictions post. It’s a planning post.…
Zero Trust is one of the most marketed concepts in cybersecurity. It’s also one of the most misunderstood. If you’ve sat through enough vendor presentations, you’ve heard it positioned as a product — something you buy, deploy, and check off the maturity model. The reality is different, and the gap between the marketing narrative and…
Summer is operationally the most complicated season for security teams, and it’s rarely discussed that way. The conversation tends to focus on threat actors and external risks. The more immediate problem is internal: interns onboarding with broader access than they need, senior staff on extended PTO, temporary employees hired for seasonal peaks, and an organizational…
Ransomware response has been a standard component of incident response planning for nearly a decade. Most organizations with a mature security program have a ransomware playbook — escalation paths, isolation procedures, backup recovery processes, and a decision framework around payment. The problem is that the environment those playbooks were written for has changed significantly, and…
For years, CISA served as a meaningful resource for organizations outside the enterprise security tier — threat intelligence sharing, incident response support, vulnerability advisories, regional coordination, and cybersecurity assessments available at no cost to critical infrastructure operators and public sector entities. That resource base has eroded significantly, and the organizations that haven’t adjusted their programs…
Graduation season is here, and if you’re about to finish a cybersecurity degree, a bootcamp, or a certification program and step into your first job search, congratulations — and also, fair warning: the gap between what academic programs prepare you for and what the job actually looks like is real, and nobody warns you about…
The AI governance conversation has been running in the background for most organizations — something to monitor, something to address eventually, something for legal to sort out. That posture has an expiration date, and for many businesses, it’s August 2026. The EU AI Act’s major provisions go fully into effect on August 2, 2026. Organizations…
Every year on March 31st, the security community celebrates World Backup Day. Vendors tweet reminders. IT teams run awareness campaigns. Someone in marketing makes a clever graphic about the 3-2-1 rule. And every year, organizations that had backups still lose everything to ransomware. That’s because we’ve been celebrating the wrong thing. We’ve been celebrating the…