Presumably you know details about your recruiting cycle -- when it starts (if there is a "recruiting season"), steps in posting job announcements, advertising on job boards, engagement with HR, etc. Does your recruiting cycle end? If you have an "ongoing recruitment" cycle, why is that? Most clients we work with actively "recruit talent" on an ongoing basis because, well, that's how they do things. When nudged they will say it's because you just never know when The Best Candidate will be available, or they will need to be "agile" under changing work conditions, etc. But to your candidates, especially the best ones, "ongoing recruitment" is a turn-off. It sets up people to feel 'ghosted' when they apply and never hear back from you -- which on your end has a rationale such as "we were training our AI" or "we wanted to see what the market looked like" or "we were overwhelmed with candidates and did...

Thank you to all veterans, not just for your service but for your sacrifices. (image credit: <a href="https://commons.wikimedia.org/wiki/File:Papaver_Rhoeas_Far-gh_01.jpg">Far-gh</a>, <a href="https://creativecommons.org/licenses/by-sa/4.0">CC BY-SA 4.0</a>, via Wikimedia Commons)

When you think of what a new cyber-defender would do, you think in terms of tasks: check logs, update software, review procedures, etc.* Consider that this task-based thinking limits your team's performance: you need to think in terms of competencies. Make sure you're using the right competencies.  A reliable source, ONETONLINE.ORG, is here to help. A search through ONET for "cybersecurity" identified 20 occupations that touch on cybersecurity even if tangentially. Two should catch your attention: Information Security Analysts (occupation # 15-1212.00) and  Information Security Engineers (occupation # 15-1299.05). These occupational descriptions are excellent for a basic, entry-level cyber-defender job description though they reflect industry averages. Small and new operations could start understanding the role better at an entry level by starting here. But. You may not be tracking that the US government, as per Executive Order 13434, directs federal agencies and t...

Agricultural monoculture is the practice of cultivating one particular crop to the near-exclusion of all others. An example of why this happens is pre-famine Ireland: the potatoe arrives from South America and became a huge success. Potatoes were so easy to grow in Ireland and such a good foodstuff that pre-famine Ireland grew them to the exclusion of most other crops. This enormous success led to monoculture farming: all potatoes, all the time. Then came the potato blight which ravaged those potatoes and was an important cause of the famine  (1845-1849). The famine was part of a larger European potato crop failure because monocultural farming of potatoes was not a solely Irish phenomenon. Cybersecurity is a kind of risk management. An occupational hazard of working in cybersecurity is an obsession with risk. That said, I see a similar possible risk in the rapid adoption of AI, especially agentic AI, in the workplace. If agentic AI becomes the de facto  replacement entry-level...

Where do you actually spend your cybersecurity time and money? Salary? Hardware? Training? Consultants? AI? (Note that this question is not useful unless and until you have an effective, evidence-based Cybersecurity Program up and running.) Most of us don't actually know the answer to that question. Finding that answer is an interesting exercise that should be part of cybersecurity leader's annual to-do list. You can find out with these deceptively simple steps: Write out your group's priorities Match your budget to those priorities Match your actual spending  to those priorities Match your person hours with those priorities The fact is that we all have a bit of a gap between what we think we value and what our actions indicate that we value. This gap tends to drift over time without conscious realignment,  so regular checking is a good idea. But checking is, itself, neither cheap nor easy so only check when you are in a position to actually make good use of the data. If yo...

Technical Debt is a term used by software developers to refer to aspects of their code base which they know were expedient or short cuts and which may need to be fixed or expanded some day. For example, assuming that all money amounts are USD, or assuming that all dates and times are in a particular timezone. Like financial debt, technical debt can be a useful tool or it can be a time bomb waiting to blow up your company. The difference is in understanding and managing the risks and the rewards. I will digress to give an example for those readers for whom this is all terribly abstract. If you do not need an example, feel free to skip the following paragraph. Once upon a time I wrote a Laboratory Management System (LMS) and provided a powerful patient lookup tool. What I did not provide was much in the way of navigating lists of patients because there weren't many patients to view in any of the systems. This was fine for the initial release. Things went well and that meant that the ...