Agricultural monoculture is the practice of cultivating one particular crop to the near-exclusion of all others. An example of why this happens is pre-famine Ireland: the potatoe arrives from South America and became a huge success. Potatoes were so easy to grow in Ireland and such a good foodstuff that pre-famine Ireland grew them to the exclusion of most other crops. This enormous success led to monoculture farming: all potatoes, all the time. Then came the potato blight which ravaged those potatoes and was an important cause of the famine  (1845-1849). The famine was part of a larger European potato crop failure because monocultural farming of potatoes was not a solely Irish phenomenon. Cybersecurity is a kind of risk management. An occupational hazard of working in cybersecurity is an obsession with risk. That said, I see a similar possible risk in the rapid adoption of AI, especially agentic AI, in the workplace. If agentic AI becomes the de facto  replacement entry-level...

Where do you actually spend your cybersecurity time and money? Salary? Hardware? Training? Consultants? AI? (Note that this question is not useful unless and until you have an effective, evidence-based Cybersecurity Program up and running.) Most of us don't actually know the answer to that question. Finding that answer is an interesting exercise that should be part of cybersecurity leader's annual to-do list. You can find out with these deceptively simple steps: Write out your group's priorities Match your budget to those priorities Match your actual spending  to those priorities Match your person hours with those priorities The fact is that we all have a bit of a gap between what we think we value and what our actions indicate that we value. This gap tends to drift over time without conscious realignment,  so regular checking is a good idea. But checking is, itself, neither cheap nor easy so only check when you are in a position to actually make good use of the data. If yo...

Technical Debt is a term used by software developers to refer to aspects of their code base which they know were expedient or short cuts and which may need to be fixed or expanded some day. For example, assuming that all money amounts are USD, or assuming that all dates and times are in a particular timezone. Like financial debt, technical debt can be a useful tool or it can be a time bomb waiting to blow up your company. The difference is in understanding and managing the risks and the rewards. I will digress to give an example for those readers for whom this is all terribly abstract. If you do not need an example, feel free to skip the following paragraph. Once upon a time I wrote a Laboratory Management System (LMS) and provided a powerful patient lookup tool. What I did not provide was much in the way of navigating lists of patients because there weren't many patients to view in any of the systems. This was fine for the initial release. Things went well and that meant that the ...

You probably believe in generational differences. Much like your horoscope sign, you know what "generation" you are in -- Gen Alpha, Gen Z, Millennial, Gen X, Boomers. And much like your horoscope sign you believe that you share beliefs, traits, attitudes, etc. with stereotyped others in your generation. It is my job as a behavioral scientist to tell you that "generational differences" do not exist . (I've almost given up hope trying to tell people that horoscope signs don't exist.) However, it is my personal nature as well as my other job as a behavioral scientist to tell you that while "generational differences" don't exist, behavioral challenges differ between decades, and because of these challenges there may be different approaches to these challenges that people in different age groups take. Since the history of recorded time the more senior age cohorts and more junior age cohorts have had, let's call them, "observations" ab...

I have been asked what we mean when we say that we can tune your team dynamics. Since I have lots of experience observing team dynamics but little experience fixing them I turned to my teammate, Emily (see below) for help on this post. Helping your teams perform at their best starts with the basic understanding that people (with their unique talents) behave differently in different systems. The most basic of these systems in the workplace is the team itself and the dynamics at play. Some teams allow talent to thrive and other team dynamics create a less favorable environment. Because a terrific team doesn't get much attention, when people ask us about team dynamics, they are often thinking specifically about a toxic team. So here is my favorite example of a toxic team dynamic, drawn from real life. Imagine a cybersecurity group (CSG) that has a super star, Sally. Sally is awesome. She does great work and does it quickly and reliably. She is always there to help those who need it. A...

Agentic AI is not a tool in the conventional sense. A technologist with Agentic AI is not simply doing their usual job, but with some help. They are doing a new job and not the one for which you hired them. The current best practice for a technologist using Agentic AI is to use a swarm of agents for each task. This means that your solo technologist now has to divide their tasks up into practical chunks, assign each chunk to an autonomous entity and then keep track of those entities while they work. In other words, every solo technologist in this model is a supervisor. Instead of being a tool whose purpose is to enhance your solo practitioner's productivity, Agentic AI is a team of virtual assistants who do the task instead of your solo practitioner. Is this reality good? Sometimes. Is this fact something you can just ignore? Absolutely not. The problem is that even when Agentic AI works perfectly it makes demands on your solo practitioner which are very different from the demands i...