Where do you actually spend your cybersecurity time and money? Salary? Hardware? Training? Consultants? AI? (Note that this question is not useful unless and until you have an effective, evidence-based Cybersecurity Program up and running.) Most of us don't actually know the answer to that question. Finding that answer is an interesting exercise that should be part of cybersecurity leader's annual to-do list. You can find out with these deceptively simple steps: Write out your group's priorities Match your budget to those priorities Match your actual spending  to those priorities Match your person hours with those priorities The fact is that we all have a bit of a gap between what we think we value and what our actions indicate that we value. This gap tends to drift over time without conscious realignment,  so regular checking is a good idea. But checking is, itself, neither cheap nor easy so only check when you are in a position to actually make good use of the data. If yo...

Technical Debt is a term used by software developers to refer to aspects of their code base which they know were expedient or short cuts and which may need to be fixed or expanded some day. For example, assuming that all money amounts are USD, or assuming that all dates and times are in a particular timezone. Like financial debt, technical debt can be a useful tool or it can be a time bomb waiting to blow up your company. The difference is in understanding and managing the risks and the rewards. I will digress to give an example for those readers for whom this is all terribly abstract. If you do not need an example, feel free to skip the following paragraph. Once upon a time I wrote a Laboratory Management System (LMS) and provided a powerful patient lookup tool. What I did not provide was much in the way of navigating lists of patients because there weren't many patients to view in any of the systems. This was fine for the initial release. Things went well and that meant that the ...

You probably believe in generational differences. Much like your horoscope sign, you know what "generation" you are in -- Gen Alpha, Gen Z, Millennial, Gen X, Boomers. And much like your horoscope sign you believe that you share beliefs, traits, attitudes, etc. with stereotyped others in your generation. It is my job as a behavioral scientist to tell you that "generational differences" do not exist . (I've almost given up hope trying to tell people that horoscope signs don't exist.) However, it is my personal nature as well as my other job as a behavioral scientist to tell you that while "generational differences" don't exist, behavioral challenges differ between decades, and because of these challenges there may be different approaches to these challenges that people in different age groups take. Since the history of recorded time the more senior age cohorts and more junior age cohorts have had, let's call them, "observations" ab...

I have been asked what we mean when we say that we can tune your team dynamics. Since I have lots of experience observing team dynamics but little experience fixing them I turned to my teammate, Emily (see below) for help on this post. Helping your teams perform at their best starts with the basic understanding that people (with their unique talents) behave differently in different systems. The most basic of these systems in the workplace is the team itself and the dynamics at play. Some teams allow talent to thrive and other team dynamics create a less favorable environment. Because a terrific team doesn't get much attention, when people ask us about team dynamics, they are often thinking specifically about a toxic team. So here is my favorite example of a toxic team dynamic, drawn from real life. Imagine a cybersecurity group (CSG) that has a super star, Sally. Sally is awesome. She does great work and does it quickly and reliably. She is always there to help those who need it. A...

Agentic AI is not a tool in the conventional sense. A technologist with Agentic AI is not simply doing their usual job, but with some help. They are doing a new job and not the one for which you hired them. The current best practice for a technologist using Agentic AI is to use a swarm of agents for each task. This means that your solo technologist now has to divide their tasks up into practical chunks, assign each chunk to an autonomous entity and then keep track of those entities while they work. In other words, every solo technologist in this model is a supervisor. Instead of being a tool whose purpose is to enhance your solo practitioner's productivity, Agentic AI is a team of virtual assistants who do the task instead of your solo practitioner. Is this reality good? Sometimes. Is this fact something you can just ignore? Absolutely not. The problem is that even when Agentic AI works perfectly it makes demands on your solo practitioner which are very different from the demands i...

  What could be scarier than a ghost or goblin demanding candy? How about A GIANT YELLOWJACKET MADE OF GOURDS! It's time again for the monthly litany of the hacked. This is our recitation of entitles that have been hacked or cyber-attacked, that we know of, in the recent month. The point of the litany is awareness that these things happen, and therefore we like to encourage pooling resources and ideas to increase your odds of success. The litany seems to have bulked up on Halloween candy and now includes: Binance...TFG London...Ahold Delhaize (supermarket multi-national holding company), specifically targeting grocery store refrigerators...Frontline Education...Moderna...Quest Diagnostics (again)...Anthropic (by a DOGE alumni-founded company, Cathedral)...Dyfed-Powys Police...State of Arizona court systems...Ogi Networks Limited (ONL) and Data Cymru (entities that had passwords of, yes really, Password1)...AfD (showing that sometimes the right people get  hacked)... ConnectWis...