InfoSec Made Easy

Sign in Subscribe

Latest

The VP Asked What Your Team Delivered This Quarter and You Brought 106 Rows: Build a CSF Category Scorecard

The VP Asked What Your Team Delivered This Quarter and You Brought 106 Rows: Build a CSF Category Scorecard

The views expressed are my own and do not represent those of my employer. This is post 2 of 3 in the Security Metrics by Audience series. The previous post in the series built a team level Subcategory scoreboard so analysts know what they are scored on. This post moves

Friday at 4:40 PM and the 72 Hour Clock Is Running: A CIRCIA Readiness Plan Before the Final Rule Lands

Friday at 4:40 PM and the 72 Hour Clock Is Running: A CIRCIA Readiness Plan Before the Final Rule Lands

You Are Three Years In and Wondering What Comes Next: The Ten Year Plan From Analyst to CISO

You Are Three Years In and Wondering What Comes Next: The Ten Year Plan From Analyst to CISO

Your Analyst Asked What the Team Is Scored On and You Had Nothing: Build a Subcategory Scoreboard With NIST CSF 2.0

Your Analyst Asked What the Team Is Scored On and You Had Nothing: Build a Subcategory Scoreboard With NIST CSF 2.0

The Supplier's Notice Landed on a Tuesday: Own the Vendor Vulnerability and Brief the Board on Exposure Windows

The Supplier's Notice Landed on a Tuesday: Own the Vendor Vulnerability and Brief the Board on Exposure Windows

The Caller Said He Was From IT: Close the Exposure Patching Will Never Fix

The Caller Said He Was From IT: Close the Exposure Patching Will Never Fix

More Than 30 Water Utilities Lost Control in a Weekend: Give Every Unpatchable Controller an Owner and an End Date

More Than 30 Water Utilities Lost Control in a Weekend: Give Every Unpatchable Controller an Owner and an End Date

Security Leadership

The VP Asked What Your Team Delivered This Quarter and You Brought 106 Rows: Build a CSF Category Scorecard

The VP Asked What Your Team Delivered This Quarter and You Brought 106 Rows: Build a CSF Category Scorecard

The views expressed are my own and do not represent those of my employer. This is post 2 of 3 in the Security Metrics by Audience series. The previous post in the series built a team level Subcategory scoreboard so analysts know what they are scored on. This post moves

Friday at 4:40 PM and the 72 Hour Clock Is Running: A CIRCIA Readiness Plan Before the Final Rule Lands

Friday at 4:40 PM and the 72 Hour Clock Is Running: A CIRCIA Readiness Plan Before the Final Rule Lands

Your Analyst Asked What the Team Is Scored On and You Had Nothing: Build a Subcategory Scoreboard With NIST CSF 2.0

Your Analyst Asked What the Team Is Scored On and You Had Nothing: Build a Subcategory Scoreboard With NIST CSF 2.0

The Supplier's Notice Landed on a Tuesday: Own the Vendor Vulnerability and Brief the Board on Exposure Windows

The Supplier's Notice Landed on a Tuesday: Own the Vendor Vulnerability and Brief the Board on Exposure Windows

The Caller Said He Was From IT: Close the Exposure Patching Will Never Fix

The Caller Said He Was From IT: Close the Exposure Patching Will Never Fix

More Than 30 Water Utilities Lost Control in a Weekend: Give Every Unpatchable Controller an Owner and an End Date

More Than 30 Water Utilities Lost Control in a Weekend: Give Every Unpatchable Controller an Owner and an End Date

Patched on Monday, Owned Since July: What Q3 2026 Taught CISOs About the Network Edge

Patched on Monday, Owned Since July: What Q3 2026 Taught CISOs About the Network Edge

Building Your Career

You Are Three Years In and Wondering What Comes Next: The Ten Year Plan From Analyst to CISO

You Are Three Years In and Wondering What Comes Next: The Ten Year Plan From Analyst to CISO

The views expressed are my own and do not represent those of my employer. Most CISOs did not plan the path; you can. Look at how most people reach the title. A good manager tapped them on the shoulder. An incident landed on their desk and they stayed to finish

Application Security Engineer: Fixing the Code Before Attackers Find It

Application Security Engineer: Fixing the Code Before Attackers Find It

GRC Analyst: The Business Side of Security Nobody Talks About

GRC Analyst: The Business Side of Security Nobody Talks About

Incident Responder: The Career for People Who Run Toward the Fire

Incident Responder: The Career for People Who Run Toward the Fire

Identity and Access Management: The Role That Controls Every Door in the Building

Identity and Access Management: The Role That Controls Every Door in the Building

Cloud Security Engineer: The Role That's Reshaping Cybersecurity

Cloud Security Engineer: The Role That's Reshaping Cybersecurity

Zero Trust — From Concept to Board Room Post 4 of 4

Zero Trust — From Concept to Board Room Post 4 of 4

The Threat Landscape

Post-Quantum Cryptography: Why CISOs Need to Start Now, Not When Quantum Arrives

Post-Quantum Cryptography: Why CISOs Need to Start Now, Not When Quantum Arrives

NIST finalized PQC standards in 2024. Adversaries are harvesting your encrypted data today. Here's what CISOs need to do right now before the window closes.

Project Glasswing & Claude Mythos: What CISOs Need to Know Right Now

Project Glasswing & Claude Mythos: What CISOs Need to Know Right Now

White House National AI Policy Framework: What CISOs Need to Know and Do Now

White House National AI Policy Framework: What CISOs Need to Know and Do Now

OpenClaw and Personal AI Assistants: Emerging Threats and What CISOs Need to Do Now

OpenClaw and Personal AI Assistants: Emerging Threats and What CISOs Need to Do Now

Shadow AI — What New CISOs Need to Do Before It Bites Them

Shadow AI — What New CISOs Need to Do Before It Bites Them

Understanding India's DPDP Act

Understanding India's DPDP Act

CISO Weekly Brief: Zero-Day Exploits, Identity Threats, and AI Abuse (Feb 12, 2026)

Breaking In

More

Building Your First Blue Team Home Lab: What a CISO Actually Recommends

InfoSec Certifications, Home Labs, and the Skills That Actually Get You Hired

Breaking Into Information Security: The Complete Guide for Beginners

How to Prepare for an Information Security Interview (and Stand Out)

Getting Your First Information Security Job: Why Courage and Outreach Matter More Than Another Resume