The world through a CISO's eyes
Building the Enterprise Identity Operating Model challenges the legacy view of identity as simply an access permission model. Instead, it defines identity as a continuously evaluated risk construct, requiring centralized visibility, policy orchestration, and lifecycle control.
My new release provides a step-by-step model of controls enterprise's must consider when building out a modern identity management infrastructure.
An interview with Expert Insights on the challenges of CISO liability, organization structure, and breach response time.
Root to CISO podcast where we discuss the security industry, and topics like certifications, experience, and the need for college degrees.
An interview with the Wall Street Journal around the new AI Executive Order and the federal 'safety check' being proposed.
An interview with CISOVoice around on Identity sprawl, being a CISO, the gap between authority and expectations, and why boards that understand the difference end up with better security programs.
Chronicles of a CISO has been ranked 8th of the Top-20 Best CISO blogs on Feedspot
A recap of my NIST CSF Maturity Toolkit session for RSAC 2025.
This panel discussion, as part of the Digital Risk North America virtual event, focuses on Risk Preparedness in the Age of Policy Volatility
Virtual CISO Moment podcast with Greg Schaffer. We discussed the challenges facing SMBs when it comes to security and how we need to fix the model.
Chronicles of a CISO has been named to the Top-100 Best Information Security blogs on Feedspot
This panel discussion, as part of the Digital Risk North America virtual event, focuses on the anticipated regulatory changes from the incoming Trump administration.
A panel discussion, as part of the PrivSec Global event, that focuses on the complexities of insider threats, exploring the motivations behind them, detection methods and effective mitigation strategies.
This panel discussion, as part of the GRC World Forums Digital Risk US virtual event, focuses on implementing best practices for Zero Trust Architectures.
A discussion with Scott Lang, VP of Product Marketing at Prevalent, as we explore the emerging trends in TPRM and provide actionable insights to help you stay ahead of your third-party risks.
An on-demand webinar around effectively managing inherent and residual third-party risks and their importance for a durable third-party risk management (TPRM) program.
The perimeter is dissolving. Employees are using any device from any location for work. With limited visibility from our traditional networking and endpoint security controls, how do we protect our data?
The perimeter is dissolving. Employees are using any device from any location for work. With limited visibility from our traditional networking and endpoint security controls, how do we protect our data?
The concept of Identity is critical to what we do. If it didn't exist, how would it change your approach and how would you answer the question?
An interview with The Times (UK) around the need for an effective awareness and training program to manage the rapid growth of the remote workforce.
I recently had a wonderful opportunity to sit in on a panel discussing how the pandemic is going to change the way security practitioners think about protecting their organizations.
I had the honor of participating in the LinkedIn Live event on some of the scarest things I have ever heard from my security team.
I had an opportunity to reflect on what is takes to be a CISO, how I got here, and where I think the industry is heading.
Panel discussion on third-party risk. Topics included conducting software composition analysis (SCA), assessing threats and impacts, risk-rating your inventory, and selecting the right controls.
An interview with the Wall Street Journal around the rapid uptick in enterprise attacks seen amongst the initial weeks of the COVID-19 outbreak.
An interview with the Wall Street Journal around the need for an effective identity management solution to manage the rapid growth of the remote workforce.