Examines frameworks, methodologies, and practical approaches for identifying, assessing, and mitigating cybersecurity risks. Topics include risk assessments, threat modeling, vulnerability management, and building a risk-aware organizational culture.
posts
When Target lost 40 million credit card records in 2013, the attackers didn't breach Target directly. They compromised an HVAC vendor. Over a decade later, the playbook hasn't changed — it's just gotten more devastating. Third party vendor cybersecurity risk is now the single fastest-growing
The Framework 83% of Organizations Claim to Follow — But Few Actually Implement When the City of Dallas was hit by a devastating ransomware attack in May 2023, investigations revealed systemic gaps in risk management, incident response, and access controls — the exact areas the NIST Cybersecurity Framework was designed to address.
The Breach That Started With a Spreadsheet App In 2023, a midsize healthcare company discovered that an employee had been syncing patient records to an unauthorized cloud storage service for over eight months. The service had no encryption, no access controls, and no audit logging. By the time the security
Your Employees Already Built a Second IT Department In 2023, a Gartner survey found that 41% of employees acquired, modified, or created technology outside of IT's visibility. By now, that number has only grown. If you're asking what is shadow IT, the short answer is this:
