Most organizations have mature processes for managing human identities. Onboarding, offboarding, access reviews, least privilege — these are established practices, even if execution is inconsistent. The problem is that human identities are no longer the majority of what’s accessing your systems. Service accounts, API keys, OAuth tokens, automation scripts, and now AI agents — non-human…
The Cyber Incident Reporting for Critical Infrastructure Act has been in a holding pattern since CISA missed its original October 2025 deadline. The final rule is now expected in May 2026. If you’ve been treating CIRCIA as a future problem, that window is closing fast. RSA This post isn’t about what CIRCIA says in theory.…
The AI governance conversation has been running in the background for most organizations — something to monitor, something to address eventually, something for legal to sort out. That posture has an expiration date, and for many businesses, it’s August 2026. The EU AI Act’s major provisions go fully into effect on August 2, 2026. Organizations…
The conflict between the United States and Iran that began on February 28, 2026 moved into the cyber domain almost immediately. If you’ve been watching it as a geopolitical story and not a security operations story, it’s time to adjust your perspective. This isn’t abstract nation-state activity happening at the edges of critical infrastructure. On…
Every year on March 31st, the security community celebrates World Backup Day. Vendors tweet reminders. IT teams run awareness campaigns. Someone in marketing makes a clever graphic about the 3-2-1 rule. And every year, organizations that had backups still lose everything to ransomware. That’s because we’ve been celebrating the wrong thing. We’ve been celebrating the…
Q1 is over. The board presentation is done. The audit findings are sitting in a tracker somewhere, color-coded and assigned to people who are already busy with something else. Everyone exhales, and then — because this is how it always goes — the next ninety days start accelerating before you’ve had a chance to think…
It’s the end of Q1. You’ve spent three months firefighting, deploying patches, running tabletop exercises, and managing vendor assessments. You have mountains of data. Dashboards full of charts. Logs that could fill a library. And now someone says: “Can you put together a one-page summary for the Board?” One page. Three months of work. One…
Every spring, people get the urge to open the windows, clear out the garage, and finally deal with that closet they’ve been pretending doesn’t exist. There’s something satisfying about it — the act of knowing exactly what you have, where it is, and whether it still serves a purpose. Your network deserves the same treatment.…
It is performance review season. For many security professionals, this is a painful exercise. Why? Because in cybersecurity, success is often invisible. If you write your self-review based solely on “what went wrong” or “what I fixed,” you are underselling your value. You need to shift the narrative from “Operational Activity” to “Business Enablement.” Here…