Insights
Thought leadership themes anchored in executive cybersecurity leadership, resilience, and real incident response experience.
Articles
"Hard to Exploit" Just Died
AI didn't invent a new class of vulnerability. It deleted the excuse we used to park the old ones.
Skynet Mode Runs on Your Inference Bill
Symantec caught an autonomous attack agent that hijacks unprotected AI endpoints to do its thinking. The jailbreak is recycled. The architecture, and who pays for it, is the story.
The Ransom Business Was Built to Leak
The ShinyHunters arrests didn't expose a few bad negotiators. They exposed a model that pays the wrong people for the wrong outcome.
The Private Key Was 4
One of eMudhra's trusted CA private keys was the number 4. Browsers got patched in hours. Everything else just inherited a thirteen-year problem.
The First Shot of the Space War Won't Be a Missile
A Russian military satellite parked 500 metres from a commercial radar satellite feeding Ukraine. The space war's first shot already happened — on the ground.
The Code Went Where It Was Told
An AI pentesting agent logged into a major insurer's site by asking it to email a one-time code to any address. Six months after a clean pentest.
AI Made Your Firewall Matter Less
For twenty-five years the firewall was the line we drew between us and them. AI is erasing that line from both sides, and most budgets haven't noticed.
OpenAI's Agents Didn't Go Rogue. They Did Their Job.
Wikimedia just caught AI agents trying to turn its tools into a way out of their own sandbox. If you run anything that fetches a URL on someone's behalf, you're on the same list.
Canada Has STIR/SHAKEN. Your Phone Doesn't Know It.
Five years after the CRTC mandated caller ID authentication, spoofed calls still ring straight through. The protocol works. The follow-through never showed up.
Conference Season Is Here. Pick Like It Matters.
Five serious Canadian security events in about eight weeks, and your budget covers one. Stop asking which is best and start asking which fits the job.
Revolut Didn't Get Hacked. It Got Asked.
No exploit. No phished admin. Someone emailed from a real government domain asking for customer records, and Revolut sent them.
Cheap Security Software Won't Fix the Affordability Crisis
The industry is about to reprice its tools. The bill small businesses actually can't pay is a different one.
The Most Successful Attack of 2026 Doesn't Exploit Anything. It Asks Nicely.
No zero-day. No exploit. Just a box that says “prove you're human,” and a user who does exactly what it says.
Two Days to a Worm
AI just collapsed the time it takes to build a self-spreading exploit. Our patch cycles didn't move.
Most Tabletop Exercises Are Theatre
If your last tabletop produced a report and a warm feeling, you paid for theatre. Here is what a real one looks like.
The Patch Shipped Thursday. The Attackers Showed Up Wednesday.
If you run a MikroTik router with SSH facing the internet, you didn't lose a patching race. You lost a race you didn't know was on.
The FBI Just Told You Your Password Doesn't Matter
OAuth consent phishing steals nothing — the victim hands over a real, platform-issued grant. Password resets and MFA re-enrolment don't kick the attacker out. A tenant setting does.
The 2040 Pause Nobody's Actually Taking
A response to ai-2040.com's "Plan A": wanting a slowdown is easy. Engineering one that survives China's incentives, an unverifiable capability metric, and a deadline that accelerates the race is the hard part.
An Autonomous SOC Can Make a Provider More Profitable. Whether It Catches More Is a Separate Question.
Every AI SOC pitch leads with a margin story. Ask for the detection story next — nobody is volunteering it.
AI Agents Don't Have a Password Problem. They Have an Identity Problem.
Non-human identities now outnumber people roughly 80 to 1. Agents authenticate, act, and move at machine speed through accounts nobody governs like a human's badge and login.
The First Security Hire Isn't a Smaller CISO. It's a Different Job Entirely.
A CISO inherits a program. A first security hire builds the org chart the program will eventually live on. Those are not the same skill, and hiring for the wrong one is how good candidates fail at good companies.
Everyone's Shopping for NAC Wrong
Network access control came back from the dead, and every mid-market team is running an evaluation. Most are getting it wrong before the first demo is booked.
Gunra Isn't Using a Zero-Day. It's Using the Fortinet Bug You Didn't Patch.
The FBI and CISA just named Gunra, a ransomware crew hitting critical infrastructure on four continents. The front door isn't exotic — it's two Fortinet flaws that already have patches.
The Master Key Problem: Why Your MSP's Best Tool Is a Risk to You
Your MSP holds a master key to everything you own. The N-able N-central exploitation is not an N-able story — it's the predictable result of how the managed services model is built.
The Inbox Is Still the Front Door
A hacker doesn't need to break your firewall. They need to send one convincing email. Why AI has made Business Email Compromise cheaper and better at the same time — and what actually holds up against it.
"We're Ready" Is Just "We're Secure" With Better PR
Arctic Wolf is right that belief isn't readiness. The fix isn't a sharper principle or a new platform — it's a number you can put in front of your board and show climbing.
Your Session Will Get Stolen. Here's How to Make It Worthless.
A practical Monday-morning checklist for making stolen session tokens useless and catching the after-party fast. Follow-up to the Kali365 piece.
Kali365 Isn't Your Problem. Your Session Cookie Is.
A new phishing kit got a name this year and the whole industry lost the plot. Kali365 doesn't want your password — it wants what comes after the login.
What Makes a Great vCISO?
Every fractional CISO can hand you a strategy deck. The distance between good and great shows up in whose name is actually on the incident report.
Nobody Fires Their MSSP on a Quiet Week. They Fire You the Morning They Heard It From Someone Else.
Retention in managed security isn't won in the quarterly review. It's decided at 4 a.m., on the one night the client finds out whether "we've got you covered" was ever true.
What Makes a Great MSSP?
Every provider can recite the same checklist. The distance between good and great now gets measured in seconds, not features — and it only shows up on the worst week of the year.
What Makes a Great MSP?
Every provider can recite the same checklist. The distance between good and great shows up somewhere the checklist doesn't look — and it usually takes three years to find out which one you actually hired.
You Built on Cheap AI. The Cheap Part Is Ending.
The $20-a-seat AI era was a land grab, not a business model. The repricing has already started — and if your operations, headcount, and workflows now assume the AI is there at yesterday's price, you have a single point of failure priced by someone else.
What If We Never Reach AGI?
We've spent a decade arguing about what happens when machines get smarter than us. The version where they don't is worth a look too — and it should change how you plan, even if it doesn't change whether you keep building.
The EU Cyber Resilience Act: An Executive Guide
The Cyber Resilience Act isn't another GDPR. It's a product law that reaches into almost every connected thing your company makes, sells, or quietly embeds — and the clock is closer to the wall than most boards have admitted out loud.
The MDR Market in 2026: A Practitioner's Reality Check
Over 60 vendors will tell you, with a straight face, that they offer 24/7 expert-led MDR. Some actually do. Many don't. Here's what I wish someone had told me before I started evaluating.
Most MSSPs Pass the Demo. Far Fewer Pass an Actual Incident.
What you are buying from an MSSP is a promise. The demo goes well, the early reports read reasonably — then something real happens, and you find out which of the promises were operational and which were marketing.
Most MSP Failures Look the Same. Here's What to Watch For.
Every business gets to a point where it cannot keep running its own IT. Hiring an MSP rarely puts the problem somewhere else as cleanly as the brochure suggests — and the failures all look the same.
Why Cyber Roll-Ups Seldom Deliver What They Promise
Every few years, somebody decides cybersecurity is the next great consolidation play. The press releases use words like platform and scale and synergy. Two or three years later, the firms quietly start losing the people who made them worth buying.
The Cloud Migration Security Debt Nobody's Counting
We moved to the cloud faster than we knew how to secure it. The bill for that is still sitting there, unopened, in nearly every environment I see.
Zero Trust Is a Strategy, Not a Product
The vendor market has turned "zero trust" into a product category. It is not. It is an architectural philosophy, and buying a product labeled "zero trust" without understanding the philosophy is expensive and ineffective.
Why Your Third-Party Risk Program Is a Spreadsheet, Not a Strategy
Most third-party risk programs give organizations a false sense of visibility. They know how many vendors completed questionnaires. They do not know which vendors could take them down.
Small and Mid-Size Doesn't Mean Small and Mid-Risk
The ransomware operator targeting a 50-person law firm does not offer a discount because the firm is small. The attack is the same. The impact, relative to the organization's ability to absorb it, is often worse.
The Cloud Migration Security Debt Nobody's Counting
Most organizations migrated to the cloud faster than their security programs adapted. The result is a growing body of security debt that compounds with every workload moved, every identity created, and every default configuration accepted.
What I Tell Organizations After They've Been Breached
The breach itself is a technical event. What happens next — the decisions, the communication, the leadership — determines whether the organization recovers its credibility or loses it permanently.
Why Your Incident Response Retainer Isn't What You Think It Is
Having an incident response retainer is not the same as being prepared for an incident. Most organizations learn the difference at exactly the wrong time.
The Cyber Insurance Conversation Most Organizations Are Having Too Late
By the time most organizations start thinking seriously about cyber insurance, they have already made decisions that will determine their coverage, their premiums, and whether a claim gets paid.
The Cloud Visibility Gap
Why what you can't see in your cloud storage is your greatest security risk. The gap between assumption and reality is where the next generation of breaches will originate.
The Questions Your Board Should Be Asking About AI Security (But Isn't)
Most board conversations about AI security fall into one of two failure modes: they are either so technical that non-technical directors disengage, or so vague that nothing actionable results. Here is what a useful one actually looks like.
How to Talk to a Board About Cyber Risk (Without Losing the Room)
The CISO board briefing is one of the most consistently mishandled conversations in corporate governance. Here is what I learned from both sides of the table.
Why Your Security Awareness Training Isn't Working
Most security awareness programs are designed to satisfy auditors, not change behavior. The difference is significant, and your incident data is showing it.
The Untold Story of The Atlantic Security Conference: Reframing the Cybersecurity Talent Landscape
Fifteen years ago, there were doubts that Atlantic Canada had a cybersecurity community large enough to sustain a conference. What happened next shows what communities can achieve once momentum begins.
What Being Swatted Taught Me About Personal Security
On January 3rd, 2025, armed officers showed up at my house because someone called in a fake emergency. Here's what that actually looked like — and what it taught me about a threat most of us in security haven't really thought through.
15 Years of AtlSecCon: What Community Taught Me About Security
In 2011, I organized a small security event in Halifax. Forty-two people showed up. I had no idea it would become the most important project of my career.
What CISOs Get Wrong About Enterprise Resilience
After more than 600 incident response engagements, I've noticed a pattern. The organizations that handle crises worst are rarely the ones with the smallest budgets or the weakest technology.
The Leadership Test Every Cyber Incident Reveals
A cyber incident doesn't create a leadership crisis. It reveals one that was already there. In 600+ incident response engagements, the technical containment is almost never the hardest part.
Core Themes
- The Cyber Resilience Leadership Framework
- What 600+ incident response engagements teach leaders
- The executive role in cybersecurity
- Incident preparedness as a leadership discipline
- Security leadership in the AI era
Featured Concept
The Cyber Resilience Leadership Playbook is a signature thought leadership platform built around lessons from 600+ incident response engagements.