Christian T.

Oct 4, 2026

Board cyber reporting has a recurring genre: the traffic-light dashboard where everything is amber, nothing is urgent, and the same three risks have been amber since the last reorganisation. Amber is not a risk position. It is a way of avoiding a decision while appearing to have made one.

Useful board reporting answers three questions. What could hurt us most, what are we doing about it, and what do you need from us. If a slide cannot be tied to one of those, it is decoration, however well it has been aligned.

Fewer metrics, each with an owner and a date, will do more than a forty page pack ever has. I remain open to evidence otherwise, preferably in a single paragraph.

View post

Sep 28, 2026

A misconception I hear often, from otherwise sensible clients: "we're too small to be a target." Attackers do not check headcount before choosing a mark, they check for exposed RDP, reused passwords, and a finance team that will move money if the email looks urgent enough. Size buys you nothing except a smaller budget to fix it with.

The second favourite is the pen test as a substitute for a security programme, one PDF a year, filed and forgotten, treated like an annual MOT that somehow certifies the car for the other 364 days. A test tells you what was true on the day. Risk does not wait politely for the next booking.

Most risk exposure clients underestimate is not exotic. It is ordinary and unpatched.

What's the most persistent myth you've had to talk a board out of this year?

View post

Sep 24, 2026

There is a particular kind of conversation I still enjoy: the one where the board wants CISO-level judgement on a budget scoped for a junior analyst, delivered on a schedule that assumes breaches also work part time. Fractional leadership works precisely because most organisations do not need someone staring at the same dashboard five days a week. They need someone who has seen the pattern before and can decide without a six-week discovery phase first.

What gets discussed less is the timing. Almost nobody calls a fractional CISO to prevent the incident. Most calls land shortly after, when the board suddenly finds twelve hours a week for security in the diary. The value was sitting there the whole time, it just was not urgent yet.

Cheaper to buy the judgement early than to rent the panic later.

View post

Sep 23, 2026

Every third party risk questionnaire I've reviewed this year has come back the same way: certificate attached, every box marked yes, and remarkably little curiosity about what actually happens behind either. Ticking a box because a supplier holds ISO 27001 is not due diligence, it is paperwork with good posture.

The uncomfortable truth is that most breaches now start three suppliers down, in a system nobody on your side has ever looked at, run by a vendor your vendor forgot to mention. Pragmatic third party risk management is not about collecting more attestations. It is about knowing which five suppliers would actually hurt you if they were compromised tomorrow, and treating those five differently from the rest of the pile.

Worth asking which five yours are.

View post

Sep 16, 2026

I'm sitting through vendor pitches at the moment where "AI-powered" gets bolted onto everything, as if the acronym alone fixes patch management. Had one this month that said it four times before telling me what the product actually did.

What I keep reminding boards is that most of the real work is unglamorous: know your assets, patch on a cadence, test your backups, and write down who's on call at 3am. None of that needs a large language model. It needs discipline, which is a much harder thing to put on a slide.

If your programme improved this year because you finally documented the incident response plan, rather than because you bought something with "AI" in the name, you're doing better than most of the pitches I sit through. Buzzwords don't stop breaches. Boring, repeatable process does.

View post