The Canon, No. 1: The Colonel Who Never Wrote a Book.
The most quoted idea in security belongs to a dead fighter pilot, and almost everyone quoting him has it wrong. The part that’s skipped is the most important one and can decide if you win.
Archive
A collection of 37 issues
Featured
The Second Payroll
Every security tool you buy hires an unapproved employee—fractional headcount spent triaging findings, tuning rules, and fixing broken integrations. Stop paying the invisible second payroll. Run the Absorption Test across your stack and start buying software that absorbs work instead of emitting it.
The $9 Billion Houseguest
Four vendors. Eight weeks. $9B in capital funding the same motion: engineers inside your company learning your business. You get their speed; they get your operating knowledge. Don't give away the tour for free.
The Agent Did It
An alert fires at 2:14 AM. Customer records are enumerated across multiple apps in ninety seconds. The authenticated actor? A service principal. In 2026, autonomous AI agents have entered production, and traditional cybersecurity playbooks are running out of road. It is time to rewrite the rules.
Posture as Code
Enterprise AI policies are written for humans but read by no one. PostureOS changes this by turning compliance into code. It delivers a machine-readable specification that governs AI agent behavior, continuously enforcing your data security and engineering standards directly at the framework levels.
Latest
After the Champagne: The 18-Month Integration Nobody Warns You About
The close simply marks the end of the beginning. The real integration—forging two digital ecosystems into one—will consume the next 18 months. It's not an IT project; it's a deep, structural business transformation, moving past the champagne into complex ERP work and application rationalization.
The M&A Integration Nobody Budgets For: Humans
Your integration dashboard might show green, but your adoption metrics will tell a different story. M&A playbooks easily cover technical integration, but often ignore the humans. Change management isn't a support function—it’s the critical enabler that stops passive disengagement in its tracks.
Dual Maintenance: The Ugliest Good Idea in Enterprise IT
Why can't we migrate everyone on Day 1 of an M&A integration? Because the business needs to operate immediately, but technology needs months. Discover why 'dual maintenance'—running both legacy and new systems—is the ugliest, yet most effective strategy for a secure, stable transition.
The 90 Days Nobody Talks About in M&A
The moment an M&A deal is signed, the real battle begins. While executives celebrate, IT and cybersecurity teams enter a high-stakes sprint. Operating in a legal gray zone, they must merge complex digital ecosystems without causing a breach. Success hinges on this secret 90-day window completely.
Why 2026 Plans Fail by February. Introducing Strategic Patience
Annual plans don’t die in Q4; they die in February when reality hits. This post introduces "Strategic Patience"—an executive playbook to survive budget whiplash. Learn to replace "January Optimism" with a 3-layer portfolio, assumption registers, and 90-day gates to bulletproof your 2026 execution.
The End of Awareness Training: Why You Need an AwarenessOS
Annual awareness training is obsolete. In an era of AI-driven threats, you don't need another program—you need an operating system for your people. This is the blueprint for AwarenessOS, a new framework for turning human risk into your greatest defensive asset.
The GenAI Divide: Beyond the 95% Failure Myth and the Workslop Epidemic
MIT revealed 95% of enterprises gain no ROI from GenAI—a headline that fuels skepticism but masks the deeper truth: the GenAI Divide. A small 5% capture massive value, while most drown in stalled pilots and workslop. Success hinges not on hype, but on governance and strategy.
A Playbook for Building an AI Governance Foundation
Don't just sprint into AI; build a foundation first. This playbook offers a 15-step roadmap to create an effective AI governance framework. Learn to mitigate risks, ensure compliance (like the EU AI Act), and transform AI from a potential liability into a powerful competitive asset.
Reclaiming the Hour: How We Used AI to Fight Administrative Bureaucracy and Put Mental Health Patients First
In my partner’s psychology practice, paperwork consumed precious hours meant for patients. Instead of costly, invasive AI tools, we built a private agent that transforms handwritten notes into progress reports—reclaiming time, protecting privacy, and putting patients first.
From the Server Room to the Strategy Table: How CISOs Can Maximize Their Impact at Top Management Gatherings
For CISOs invited to the leadership offsite, the opportunity is immense—and so is the risk of getting it wrong. This guide provides a playbook for shifting from a technical defender to a strategic business enabler, cementing your influence and embedding security into the core of business growth.