InfoSec Made Easy

Sign in Subscribe

Latest

A Stack of Audit Findings on Day Three: The CISO Priorities Checklist for Your First 30 Days, Six Months, and Year

A Stack of Audit Findings on Day Three: The CISO Priorities Checklist for Your First 30 Days, Six Months, and Year

The views expressed are my own and do not represent those of my employer. Picture a CISO on day three. She is fictional, but you may know her. She started Monday. By Wednesday afternoon, internal audit has dropped a stack of open findings on her desk, some of them two

The Audit Chair Asked What the Identity Program Returned: Turning IAM Metrics Into Risk and ROI Numbers That Hold Up

The Audit Chair Asked What the Identity Program Returned: Turning IAM Metrics Into Risk and ROI Numbers That Hold Up

Nobody Was at the Keyboard on the Attacker's Side: Decide What Your Defensive AI May Do Before the Incident Starts

Nobody Was at the Keyboard on the Attacker's Side: Decide What Your Defensive AI May Do Before the Incident Starts

The Board Asked Who Owns That Agent: Accountability, Traceability and a 90 Day Plan

The Board Asked Who Owns That Agent: Accountability, Traceability and a 90 Day Plan

Stop Asking What the Agent Did. Ask Why, and Whether It Matches the Task.

Stop Asking What the Agent Did. Ask Why, and Whether It Matches the Task.

You Can't Predict the Model, So Limit the Agent: Least Privilege and Containment for the Agentic Insider

You Can't Predict the Model, So Limit the Agent: Least Privilege and Containment for the Agentic Insider

You Can't Contain an Agent You Haven't Found: Treating AI Agents as Insiders, Starting With the Inventory

You Can't Contain an Agent You Haven't Found: Treating AI Agents as Insiders, Starting With the Inventory

Security Leadership

A Stack of Audit Findings on Day Three: The CISO Priorities Checklist for Your First 30 Days, Six Months, and Year

A Stack of Audit Findings on Day Three: The CISO Priorities Checklist for Your First 30 Days, Six Months, and Year

The views expressed are my own and do not represent those of my employer. Picture a CISO on day three. She is fictional, but you may know her. She started Monday. By Wednesday afternoon, internal audit has dropped a stack of open findings on her desk, some of them two

The Audit Chair Asked What the Identity Program Returned: Turning IAM Metrics Into Risk and ROI Numbers That Hold Up

The Audit Chair Asked What the Identity Program Returned: Turning IAM Metrics Into Risk and ROI Numbers That Hold Up

Nobody Was at the Keyboard on the Attacker's Side: Decide What Your Defensive AI May Do Before the Incident Starts

Nobody Was at the Keyboard on the Attacker's Side: Decide What Your Defensive AI May Do Before the Incident Starts

The Board Asked Who Owns That Agent: Accountability, Traceability and a 90 Day Plan

The Board Asked Who Owns That Agent: Accountability, Traceability and a 90 Day Plan

Stop Asking What the Agent Did. Ask Why, and Whether It Matches the Task.

Stop Asking What the Agent Did. Ask Why, and Whether It Matches the Task.

You Can't Predict the Model, So Limit the Agent: Least Privilege and Containment for the Agentic Insider

You Can't Predict the Model, So Limit the Agent: Least Privilege and Containment for the Agentic Insider

You Can't Contain an Agent You Haven't Found: Treating AI Agents as Insiders, Starting With the Inventory

You Can't Contain an Agent You Haven't Found: Treating AI Agents as Insiders, Starting With the Inventory

Building Your Career

Application Security Engineer: Fixing the Code Before Attackers Find It

Application Security Engineer: Fixing the Code Before Attackers Find It

Application security is where software development and cybersecurity meet, and the collision point is increasingly where organizations win or lose. As companies ship more software faster than ever before, the vulnerabilities baked into that software have become one of the primary attack surfaces that adversaries exploit. The Application Security Engineer

GRC Analyst: The Business Side of Security Nobody Talks About

GRC Analyst: The Business Side of Security Nobody Talks About

Incident Responder: The Career for People Who Run Toward the Fire

Incident Responder: The Career for People Who Run Toward the Fire

Identity and Access Management: The Role That Controls Every Door in the Building

Identity and Access Management: The Role That Controls Every Door in the Building

Cloud Security Engineer: The Role That's Reshaping Cybersecurity

Cloud Security Engineer: The Role That's Reshaping Cybersecurity

Zero Trust — From Concept to Board Room Post 4 of 4

Zero Trust — From Concept to Board Room Post 4 of 4

Zero Trust — From Concept to Board Room Post 3 of 4

Zero Trust — From Concept to Board Room Post 3 of 4

The Threat Landscape

Post-Quantum Cryptography: Why CISOs Need to Start Now, Not When Quantum Arrives

Post-Quantum Cryptography: Why CISOs Need to Start Now, Not When Quantum Arrives

NIST finalized PQC standards in 2024. Adversaries are harvesting your encrypted data today. Here's what CISOs need to do right now before the window closes.

Project Glasswing & Claude Mythos: What CISOs Need to Know Right Now

Project Glasswing & Claude Mythos: What CISOs Need to Know Right Now

White House National AI Policy Framework: What CISOs Need to Know and Do Now

White House National AI Policy Framework: What CISOs Need to Know and Do Now

OpenClaw and Personal AI Assistants: Emerging Threats and What CISOs Need to Do Now

OpenClaw and Personal AI Assistants: Emerging Threats and What CISOs Need to Do Now

Shadow AI — What New CISOs Need to Do Before It Bites Them

Shadow AI — What New CISOs Need to Do Before It Bites Them

Understanding India's DPDP Act

Understanding India's DPDP Act

CISO Weekly Brief: Zero-Day Exploits, Identity Threats, and AI Abuse (Feb 12, 2026)

Breaking In

More

Building Your First Blue Team Home Lab: What a CISO Actually Recommends

InfoSec Certifications, Home Labs, and the Skills That Actually Get You Hired

Breaking Into Information Security: The Complete Guide for Beginners

How to Prepare for an Information Security Interview (and Stand Out)

Getting Your First Information Security Job: Why Courage and Outreach Matter More Than Another Resume