InfoSec Made Easy

Sign in Subscribe

Latest

Your Analyst Asked What the Team Is Scored On and You Had Nothing: Build a Subcategory Scoreboard With NIST CSF 2.0

Your Analyst Asked What the Team Is Scored On and You Had Nothing: Build a Subcategory Scoreboard With NIST CSF 2.0

The views expressed are my own and do not represent those of my employer. Imagine a detection analyst who closes forty tickets a week, tunes rules on her own time, and finds a misconfigured log source that would have hidden an intrusion. Then her annual review arrives. It says "

The Supplier's Notice Landed on a Tuesday: Own the Vendor Vulnerability and Brief the Board on Exposure Windows

The Supplier's Notice Landed on a Tuesday: Own the Vendor Vulnerability and Brief the Board on Exposure Windows

The Caller Said He Was From IT: Close the Exposure Patching Will Never Fix

The Caller Said He Was From IT: Close the Exposure Patching Will Never Fix

More Than 30 Water Utilities Lost Control in a Weekend: Give Every Unpatchable Controller an Owner and an End Date

More Than 30 Water Utilities Lost Control in a Weekend: Give Every Unpatchable Controller an Owner and an End Date

Patched on Monday, Owned Since July: What Q3 2026 Taught CISOs About the Network Edge

Patched on Monday, Owned Since July: What Q3 2026 Taught CISOs About the Network Edge

The Scan Came Back Full of Criticals: Stop Ranking by CVSS and Build a Four Tier Short List

The Scan Came Back Full of Criticals: Stop Ranking by CVSS and Build a Four Tier Short List

The Tool List Was Out of Date by Friday: Write the Technology Ethics Policy Your AUP Can't

The Tool List Was Out of Date by Friday: Write the Technology Ethics Policy Your AUP Can't

Security Leadership

Your Analyst Asked What the Team Is Scored On and You Had Nothing: Build a Subcategory Scoreboard With NIST CSF 2.0

Your Analyst Asked What the Team Is Scored On and You Had Nothing: Build a Subcategory Scoreboard With NIST CSF 2.0

The views expressed are my own and do not represent those of my employer. Imagine a detection analyst who closes forty tickets a week, tunes rules on her own time, and finds a misconfigured log source that would have hidden an intrusion. Then her annual review arrives. It says "

The Supplier's Notice Landed on a Tuesday: Own the Vendor Vulnerability and Brief the Board on Exposure Windows

The Supplier's Notice Landed on a Tuesday: Own the Vendor Vulnerability and Brief the Board on Exposure Windows

The Caller Said He Was From IT: Close the Exposure Patching Will Never Fix

The Caller Said He Was From IT: Close the Exposure Patching Will Never Fix

More Than 30 Water Utilities Lost Control in a Weekend: Give Every Unpatchable Controller an Owner and an End Date

More Than 30 Water Utilities Lost Control in a Weekend: Give Every Unpatchable Controller an Owner and an End Date

Patched on Monday, Owned Since July: What Q3 2026 Taught CISOs About the Network Edge

Patched on Monday, Owned Since July: What Q3 2026 Taught CISOs About the Network Edge

The Scan Came Back Full of Criticals: Stop Ranking by CVSS and Build a Four Tier Short List

The Scan Came Back Full of Criticals: Stop Ranking by CVSS and Build a Four Tier Short List

The Tool List Was Out of Date by Friday: Write the Technology Ethics Policy Your AUP Can't

The Tool List Was Out of Date by Friday: Write the Technology Ethics Policy Your AUP Can't

Building Your Career

Application Security Engineer: Fixing the Code Before Attackers Find It

Application Security Engineer: Fixing the Code Before Attackers Find It

Application security is where software development and cybersecurity meet, and the collision point is increasingly where organizations win or lose. As companies ship more software faster than ever before, the vulnerabilities baked into that software have become one of the primary attack surfaces that adversaries exploit. The Application Security Engineer

GRC Analyst: The Business Side of Security Nobody Talks About

GRC Analyst: The Business Side of Security Nobody Talks About

Incident Responder: The Career for People Who Run Toward the Fire

Incident Responder: The Career for People Who Run Toward the Fire

Identity and Access Management: The Role That Controls Every Door in the Building

Identity and Access Management: The Role That Controls Every Door in the Building

Cloud Security Engineer: The Role That's Reshaping Cybersecurity

Cloud Security Engineer: The Role That's Reshaping Cybersecurity

Zero Trust — From Concept to Board Room Post 4 of 4

Zero Trust — From Concept to Board Room Post 4 of 4

Zero Trust — From Concept to Board Room Post 3 of 4

Zero Trust — From Concept to Board Room Post 3 of 4

The Threat Landscape

Post-Quantum Cryptography: Why CISOs Need to Start Now, Not When Quantum Arrives

Post-Quantum Cryptography: Why CISOs Need to Start Now, Not When Quantum Arrives

NIST finalized PQC standards in 2024. Adversaries are harvesting your encrypted data today. Here's what CISOs need to do right now before the window closes.

Project Glasswing & Claude Mythos: What CISOs Need to Know Right Now

Project Glasswing & Claude Mythos: What CISOs Need to Know Right Now

White House National AI Policy Framework: What CISOs Need to Know and Do Now

White House National AI Policy Framework: What CISOs Need to Know and Do Now

OpenClaw and Personal AI Assistants: Emerging Threats and What CISOs Need to Do Now

OpenClaw and Personal AI Assistants: Emerging Threats and What CISOs Need to Do Now

Shadow AI — What New CISOs Need to Do Before It Bites Them

Shadow AI — What New CISOs Need to Do Before It Bites Them

Understanding India's DPDP Act

Understanding India's DPDP Act

CISO Weekly Brief: Zero-Day Exploits, Identity Threats, and AI Abuse (Feb 12, 2026)

Breaking In

More

Building Your First Blue Team Home Lab: What a CISO Actually Recommends

InfoSec Certifications, Home Labs, and the Skills That Actually Get You Hired

Breaking Into Information Security: The Complete Guide for Beginners

How to Prepare for an Information Security Interview (and Stand Out)

Getting Your First Information Security Job: Why Courage and Outreach Matter More Than Another Resume