Joshua C.

Jul 8, 2026

So I saw someone do one of those LinkedIn surveys that asked if you would take a 20% pay cut to work remotely. #unpopularopinion: Location matters.

REALTORS® say it. Return-to-office or RTO advocates say it; heck, even some "leadership gurus" say it.

Location. Location. Location.

But when we talk about work, we need to stop pretending location is automatically a productivity strategy.

For some people, the office is great. They focus better. They collaborate better. They like the structure.

For others, the office is a productivity tax. Commute time. Noise. Interruptions. Forced social energy. Performative presence.

And let's not pretend that the office is free.

Office space costs money. Utilities cost money. Parking, furniture, badge systems, cleaning, insurance, physical security, coffee, conference rooms, and facilities all cost money..lots of it. I have seen it with some orgs be a larger slice of the budget than entire departments.

So when leaders frame remote work as expensive but ignore the fixed cost of maintaining office space, they are not doing P&L analysis. They are doing bad nostalgia math.

And now we have research putting language around what a lot of people already suspected. Some of the return-to-office push is not about productivity.

It is about power.

A recent organizational behavior study literally titled “Worship me at the office altar; Why narcissistic leaders resist remote work.” Yes...that is the real name of it...found that leader narcissism was associated with resistance to remote work because remote work threatens power and status.

That should make every board, CFO, HR, and frankly every leader pause.

Because if your location strategy is based on collaboration, mentorship, customer outcomes, regulatory requirements, need to access physical equipment, or role-specific performance data, great. Make the case. It should speak for itself.

But if the real driver is “I need to see my people,” “I don’t trust them unless they are in the building,” or “leadership feels more real when I have an audience,” "I need to have the office with all the bells and whistles," then call it what it is.

That is not culture.

That is control and ego.

Remote work is not magic either.

The fantasy that companies can suddenly get “Silicon Valley talent” for “backwoods Arkansas money” is also bullshit. Talent knows what it is worth. Markets adjust. People talk. Salary data exists. Some people only really thrive when they can feed off the energy of the "bull pit."

The real question is not office versus remote.

The real question is: Where does this person, in this role, doing this work, create the most value? That is when and where they should work.

BL: Location matters. But pretending one location works best for everyone is not strategy. It is ego with a badge reader.

unpopularopinionguy

View post

Jun 16, 2026

Time for #unpopularopinion: A disclaimer does not magically make your liability go away.

I keep seeing privacy policies with language that basically says:

“We do not intentionally offer services to individuals in the EEA,”

followed by some version of:

“If you access our site from the EEA, you do so on your own initiative.”

That may sound like legal armor, but it is not a force field. It is not a jurisdictional cloaking device. It is not Ctrl+Alt+Delete for regulatory exposure. At best, it is one fact in a much larger analysis. At worst, it is a company documenting that it recognized the risk and chose wordsmithing instead of governance.

The legal issue is not whether your privacy policy contains a paragraph saying you did not mean to target Europe. The issue is what your organization actually does. Do you collect personal data? Do you process it? Do you track users? Do you use analytics, cookies, pixels, lead forms, newsletters, CRM workflows, third-party processors, behavioral monitoring, sales outreach, or automated marketing? Do your services, design, campaigns, language, pricing, support model, or business operations reach people protected by the regulation? Regulators, courts, plaintiffs, and opposing counsel tend to care a lot more about facts than disclaimers.

That is the part too many companies miss.

A privacy policy is not a liability waiver. You cannot write “we did not intend to be responsible” and then treat that like a compliance program. You cannot collect data first, lawyer-word it later, and pretend the paragraph overrides the actual architecture of your website, marketing stack, product analytics, customer support process, retention schedule, or vendor ecosystem. Legal exposure usually follows conduct, not wishful drafting.

Sometimes the bad disclaimer makes it worse. Because now you have evidence that someone knew the jurisdictional issue existed. Someone knew EEA access was possible. Someone knew data might be collected from those users. And instead of implementing meaningful controls like refusing connections from EU based IPs, limiting collection by data validation, adjusting processing, managing consent, documenting lawful basis, or designing the service around the actual risk, the organization added a paragraph and hoped the law would politely look away.

That is not privacy compliance.

That is legal cosplay with production data.

#GDPR does not care about your magical thinking. If your defense is “we said we were not targeting them,” but your systems, trackers, forms, vendors, logs, and business processes say otherwise, the systems are going to be louder than the sentence.

A disclaimer is not a control.

A disclaimer is not compliance.

A disclaimer is not a get-out-of-liability-free card.

BL: If your privacy strategy depends on pretending a paragraph can erase what your systems are actually doing, you do not have a privacy strategy. You have a documented misunderstanding of risk.

#unpopularopinionguy

View post

Jun 3, 2026

When you get the chance to do CISO's in Cars with Kunal Agarwal the CEO at Dope Security, you drop some #unpopularopinion on him.

View post

May 29, 2026

The wife and I went to The Strand Theatre here in Shreveport and saw the swing band Big Bad Voodoo Daddy, so, you know me...it made the gears go. #unpopularopinion: #Cybersecurity is not a solo act.

You can hire the smartest analyst, the best engineer, the sharpest GRC lead, and the most battle-tested CISO in the room and still end up with noise instead of defense.

Because security does not work when every section is playing a different song. The SOC is chasing alerts. Engineering is shipping features. IT is fighting tickets. Legal is managing exposure. Compliance is preparing for the audit. The business is trying to move faster. Everyone is doing their job, but nobody is working from the same sheet of music.

That is how gaps become breach paths.

One team accepts a risk, another team does not know exists. One system owner thinks MFA is optional. One vendor gets onboarded because the deal had to close. One exception becomes normal operating procedure. Then, when the attacker finds the space between those decisions, everyone acts surprised.

Great cybersecurity programs are not built on hero solos. They are built on alignment. The SOC needs to understand what the business actually cares about. Engineering needs to know which risks matter before the product ships. IT needs clarity on which controls are non-negotiable. GRC needs to stop treating the sheet music as if it were the performance. Executives need to understand that security is not background noise. It is part of the arrangement.

That is the difference between a collection of talented people and a coordinated defense system.

The best teams know their parts. They know when to lead, when to support, when to improvise, and when to stop improvising because the moment requires discipline.

BL: When the right people are playing the right parts from the same sheet of music, you do not get chaos. You get resilience, and it sounds beautiful.

#unpopularopinionguy

View post