🚀 Excited to share my latest Governance, Risk, and Compliance (GRC) project completed on Cyberr, where I engineered an audit-ready, mini-Information Security Management System (ISMS) from the ground up. Simulating the role of a Cybersecurity Governance, Risk and Compliance Cons…
Schomer — Principal Security Solutions Architect & Founder
Just dropped a massive suite of 9 live services on the Heelr marketplace. I’m moving application security and compliance out of traditional bottlenecking models and into pure, automated velocity. What's live on the dashboard right now: • Deterministic Layer-Zero Validation: Neut…
Victor Manuel Font Jr — Keynote Speaker | Strategic Technology Leader | Fractional CIO | IT & Cyber Governance Expert | Published Author | FedRAMP Readiness | Board-Level Advisor | Digital Transformation | Enterprise WordPress/Formidable Forms
Organizations routinely invest in enterprise architecture, security architecture, application architecture, and data architecture because they recognize that important capabilities require intentional design. Yet governance evidence is often left to chance. Policies, meeting min…
When Machines Act for Us, Integrity Becomes the Security Question Picture a procurement agent asked to cut supplier costs by ten percent. It reads the contracts, finds a cheaper vendor, cancels three standing orders and signs a new agreement before lunch. No attacker was involve…
Schomer — Principal Security Solutions Architect & Founder
Hardening Layer Zero: Deterministic Gate Validation & Sub-Millisecond CWE-1000 Invariant Mapping on Restricted ARM64/Termux Sandbox While a significant portion of the security landscape relies on fragile, reactive signatures or heavy, high-overhead runtime agents that lose suppo…
Just defended my capstone project for the AI in Cybersecurity programme, and I'm still excited about how it went. The project simulated an end-to-end security assessment for a fictional fintech, working across four areas: researching a real threat actor and its history of target…
HOTEL PAYMENT SYSTEMS: CONVENIENCE SHOULD NOT COME AT A SECURITY RISK Hotels process payments everywhere - reception, restaurants, bars, events and online bookings. Every channel needs the right security. A poorly secured payment environment can increase the risk of: • Card data…
Hello everyone! 👋 I’m currently exploring Cybersecurity and GRC opportunities across the UK and EU and would love to connect with people in the cybersecurity community. My experience spans vulnerability management, security risk assessments, incident response, threat intelligen…
How certification became a requirement for doing business, and whether we know what we are actually buying There is a strange thing about certification. ISO standards are voluntary. Certification is performed by independent certification bodies, not by ISO itself. ISO also ackno…
Opened DORA basics this morning. Six hours later I'm writing the article: "Three Million certificates, and nobody knows if they work." That escalated quickly :)
Nikki Webb — Cybersecurity is not just technical, it is human | Protecting people, businesses & resilience
A pentest is a photo of one Tuesday. It captures the state of your app on a single day. The day after, your engineers ship again and whatever the pentester didn't see is live in production. So here's the question we're actually asking: does a single point-in-time test still coun…
I compared CISO salaries across France, Germany, the UK and the US, expecting the story to be about America. It's about France. A CISO in Paris and a CISO in Munich are carrying the same regulation. Same NIS2, same DORA, same breach exposure...one of them is paid roughly half of…
SIMON GREEN — Founder / Independent GRC & Information Security Consultant / Fractional CISO
Getting ISO 27001, SOC 2, NIS2 or DORA-ready doesn't have to mean 12 months of spreadsheets. At Sentinel42 we pair hands-on consultancy with our own ISMS platform, so the risk register, SoA, policies and evidence live in one place and stay current after the auditor leaves. → Fre…
Schomer — Principal Security Solutions Architect & Founder
CISA BOD 26-04 and the Reality of Pre-Patch CompromiseCISA’s recent addition of CVE-2026-48907 to the Known Exploited Vulnerabilities (KEV) catalog under Binding Operational Directive (BOD) 26-04 highlights a massive operational bottleneck for CISOs. Under new mandates, organiza…
Samuel Santos Belloso — Senior Cyber Strategy, Risk and Compliance
Hi everyone, I’m 23 years old and currently open to new opportunities in cybersecurity, with full flexibility to relocate internationally. At this stage of my career, I have already had the opportunity to build experience across both technical IT and cybersecurity environments.…
Patrick Bochart — Chief Information Security Officer (Freelance)
As one chapter closes, a new opportunity to drive security excellence begins. My CISO-as-a-Service mandate with parking.brussels wraps up this Friday, 11 September. I want to extend my sincere thanks to the teams there for their unwavering trust and the high-quality collaboratio…
Ireland facing €2.8m penalty plus daily fines for failing to adopt EU cybersecurity rules State remains non-compliant two years after deadline, says professional services firm Aon https://www.irishtimes.com/business/2026/08/24/ireland-facing-28m-penalty-plus-daily-fines-for-fail…
SIMON GREEN — Founder / Independent GRC & Information Security Consultant / Fractional CISO
Unpopular opinion: most ISO 27001 certificates prove one thing. You passed an audit on one particular week. They don't prove your risk register reflects the business you run today. Or that your SoA justifications would survive a real incident. Or that anyone outside the ISMS own…
That 9.8 In Your Ticket Queue Isn't Your Risk Every few months I end up having the same conversation. Someone forwards a CVE with a 9.8 next to it, the word "Critical" gets used a lot, and the implied question is why we haven't patched it yet. Usually the honest answer is that t…
Nikki Webb — Cybersecurity is not just technical, it is human | Protecting people, businesses & resilience
Pentesters aren't the problem. Annual cadence is. A penetration tester's real value isn't re-confirming the same OWASP Top 10 list once a year. It's judgement: architecture, logic, context, what actually matters to your business. The problem is the snapshot model. One report, th…