Your job as a manager in any organization is to keep your direct reports focused, deal with their personal issues, and appease your superiors. It can be thankless. In fact about 50% of managers fail, so it can also lead to joblessness.  All that for what is probably a few pennies more an hour in your paycheck compared to what you made as a front-line cyber-defender. Oh hey it's also going to get weirder soon. As we just published in yesterday's Litany of the Hacked, you can now expect not only gangs of humans to hack you but also gangs of AI models (that are "behaving in unexpected and concerning ways" -- see yesterday's post) and gangs backed by nation-states. But surely, you know, there are laws about this that will help. Well, no. In an uncomfortable piece in the NY Times this week, there is no governmental regulation coming from anywhere to rein in the aggressiveness of AI models. China? Nope. EU? Nope. US? Nope. There are laws regarding people who are hacker...

Ah yes friends, it's that time. Welcome to the litany of the hacked, September 2026 edition. There is so much noise, so much static, so little information about how AI is going to rip the guts of your SOC apart. Oh wait, maybe you have an AI SOC and then it will rip apart the guts of an attacking AI. Um, er, hold on, maybe the AIs will conspire to attack you. Or them. Who knows. Our point is not shame, but to create shared awareness to pool resources where possible and build a sense of community. Thus, the litany now includes: the FBI...Springfield (MA) Public Schools...city government of Winona, MN...Anne Arundel (MD) Medical Centers...City of Berlin...Novocure... Manchester, London Stansted and East Midlands airports ...Pixel 6 phone systems...Chrome...Microsoft Exchange...State of Florida Department of Motor Vehicles...Liquid Network...Thomson Reuters...Eagle Mountain, UT...International Meteor Union...government of the United Arab Emirates (by Iran)...AT&T in north Texas (...

High performers are difficult to find and, well, can be difficult to manage. They challenge managers to improve their own performance management skills. They out-perform, by definition, their peers. And they know it, and they expect whatever "recognition" means to them. One of the hardest skills to learn as a manager of a high-performer is how to end that person's career doing what they were doing so well so that the individual can move to a new position and contribute there. It's about taking people who were indispensable at one level and successfully promoting them. Why is this hard? Multiple reasons: 1. Being good at one set of challenges is not the same as being good at a higher-level set of challenges. The talents that made you excellent at the current level (execution, individual output, mastery of a defined problem) aren't the same traits the new level tests (ambiguity, influence, developing people instead of doing the work yourself). At the very least, tha...

Who knew that eventually Brad Pitt would end up in our blog series? Other than, of course he did. In the CISO Tradecraft® piece we've been touting recently there's a section we haven't touched yet: their case that aspiring leaders should apply ' Moneyball '-style statistics to their own careers. The point is that you're rarely promoted purely on your own merits, you're selected against whoever else happens to be in the room . Sometimes the deciding factor isn't your strength, it's the field's weakness. That's a useful, slightly uncomfortable idea, and it connects to something we've argued in this space before : climbing and performing are not the same test. Moneyball makes that concrete. If promotion decisions are relative then "I'm ready" was never the whole question. "Ready relative to who else is being considered, using what criteria, at what level" is the actual question. If that feels off-putting, CISO Tradec...

In my previous post I made the case for building a security culture instead of a leadership culture. The goal of a security culture is to bring all employees and business units, or as many as possible, into the mindset of balancing risks, understanding and supporting trade-offs, and thus enabling performance that relies on a positive view of cybersecurity instead of cybersecurity rituals. So, you may ask, how does that happen? A good place to start is in the CISO Tradecraft® piece we mentioned entitled " How to create a leadership culture ." The trick is that you need to focus on security culture, not leadership (or worse, leader) culture.  Here are six approaches that work: Master your communication about security . Tell us why, and then you can tell us how as long as we understand why. How does your program stack up against peers? If your program stinks, how does your proposed security culture move the needle? If it's good, how does your proposed security culture ena...

The good people at CISO Tradecraft® recently published a piece entitled " How to create a leadership culture ." Since this veers directly into our typical behavioral cybersecurity lane, we thought it was worth reviewing. The start is promising: "In the high-stakes world of cybersecurity, many organizations mistake “security theater”, the endless checklists, mandatory slide decks, and annual compliance box-checking, for actual security. But security isn’t a checklist; it’s a force field. And that force field is generated by your organizational culture." Great! Indeed, culture is a "force field" as we endorse this view. Thank you CISO Tradecraft! But then we diverge.  Effective behavioral cybersecurity is not about a "leadership culture" per se, it's about creating a security culture . Here's the distinction. A security culture is a force field because culture governs what behavior gets tolerated among and between team members. When behavio...

AI & Plumbing Systems Integration  In my youth I worked as a plumber's helper for a short while. This experience taught me the difference between being smart and being experienced. I was very much smarter than my boss but my boss was very much better at plumbing. Talent is a thing. Motivation is a thing. Experience is a thing. All of these things are important and all of these things come in varying degrees in the form of human beings. Or AI agents. Back to my experience as a plumber's helper. On the plus side, not only was I being humbled about the relative value of expertise and intelligence, I also spent lots of time thinking about dynamic systems so this brief employment was quite helpful when I moved into distributed information systems and then into cybersecurity. A key principle in either domain is that systems are interactive: their parts work together. This is little benefit in putting a giant V8 engine in your VW bug. There is likely great harm in raising the wate...

I have been watching a CEO replace their director of technology and this CEO is making a very common mistake with hiring technology people in general and cybersecurity people in particular. That mistake is putting too high a value on what the CEO knows and too low a value on what the CEO does not know. In my experience it is natural for there to be detail gradient from C-Suite to worker bee. Like this illustration, the level of detail is different at every level of the organization. The highest level tends to be almost devoid of operational detail. The lowest level tends to be saturated with it. This state of affairs can lead to an unfortunate and often unconscious bias that the operational details don't matter. The higher up you go, the less people at that level had to deal with them. This can lead higher ups to feel that the details are not only unimportant, but a problem, since they must see the forest and not the trees. In most cases this generalization is inaccurate to an acce...

"We are the standard." Thus spoke Breanna Stewart on 13 September 2026 after Team US beat Team France in FIBA Women's Basketball World Cup, 97 - 79.  Team USA has not lost a game since the semi-finals of this tournament in 2006. Read that again: Team USA has not lost a game since the semi-finals of this tournament in 2006 . "We are the standard," Ms Stewart, tournament MVP, said. It's a moral victory for other teams to come within 20 points of Team USA in international basketball, so, hooray Les Bleues . What about your cybersecurity function? Is it 'the standard'? If not, why not? Sorry to ask an uncomfortable question but you need to be clear-eyed about this. Everyone understands that you have budget realities, leading to competition for resources. Your team may be still forming, maybe there are lots of organizational dynamics. All of that is real. And so, is your program the standard?  Let's say it's not the standard. Do you benchmark agai...

A recent post of mine, The Circle of Cybersecurity ,  was a bit dense so I am expanding pieces of it in separate posts. This post examines the upward arrow that flows from Mangers to Leaders. That arrow is labelled "Status" but that is a bit of shorthand for the related kinds of information that travel that path. In this post we are focusing on large organizations with a Cybersecurity Program (CSP) run by a dedicated staff. We assume that any such organization has a rigorous CSP, based on some formalized principles such as the NIST CSF. Status Like "evidence," "status" is a concept we all think we understand until we need to define it. One of the big steps in implementing a good CSP is agreeing on the compromise that is status. There is always compromise because there are limits to what the evidence the Managers have been given and there are limits on what the Leaders can comprehend and absorb. One colleague of mine once joked that "boardroom reports...

A recent post of mine, The Circle of Cybersecurity ,  was a bit dense so I am expanding pieces of it in separate posts. This post examines the upward arrow that flows from Cybersecurity Engineers (CSEs), the folks on the front lines, to Managers. That arrow is labelled "Evidence" but that is a bit of shorthand for the related kinds of information that travel that path. In this post we are focusing on large organizations with a Cybersecurity Program (CSP) run by a dedicated staff. We assume that any such organization has a rigorous CSP, based on some formalized principles such as the NIST CSF. Evidence In most social situations demanding proof that people are doing what they said they would do is rather rude. This taboo has lead to a dismaying number of CSPs being "faith-based" by which I mean that Managers have faith in their CSEs and assume that all is well unless and until something goes wrong. Alas, politeness is not what is needed in an effective CSP. In cyberse...

A recent post of mine, The Circle of Cybersecurity ,  was a bit dense so I am expanding pieces of it in separate posts. This post examines the second downward arrow, what flows from Managers Cybersecurity Engineers (CSEs), the folks on the front lines. That arrow is labelled "Procedures" but that is a bit of shorthand for the many related kinds of information that travel that path. In this post we are focusing on large organizations with a Cybersecurity Program (CSP) run by a dedicated staff. We assume that any such organization has a rigorous CSP, based on some formalized principles such as the NIST CSF. Procedures In theory all you need for your CSP is for procedures to be transmitted from Managers to CSEs. In practice, this is where the rubber meets the road. To stretch the analogy, this is where the tires of your Policies meet the road debris of previous decisions, the potholes of cyberattacks, the ice of accidents and the oil slicks of negligence. And, of course, the imp...

A recent post of mine, The Circle of Cybersecurity ,  was a bit dense so I am expanding pieces of it in separate posts. This post examines the first downward arrow, what flows from Leaders to Managers. That arrow is labelled "Policies" but that is a bit of shorthand for the many related kinds of information that travel that path. In this post we are focusing on large organizations with a Cybersecurity Program (CSP) run by a dedicated staff. We assume that any such organization has a rigorous CSP, based on some formalized principles such as the NIST CSF. Priorities In such a framework the first thing that leaders have to do is bless a list of digital assets to be protected. The managers may well provide a super set of all possible candidates, but the leaders need to impose priority on that super set. Almost no organization can protect every possible digital asset all the time. Resources Once the digital asset list is set for the time period--usually a year--then the organizati...

Ted recently wrote about the pain of rewarding performance with promotion and the purported death of the entry-level CS job . This got me thinking about the actual CS jobs that I have seen in the wild.When looking at actual CS jobs, size matters so we will start with that dimension. Small Organizations In very small organizations there isn't a Cybersecurity Program (CSP) so much as there is a guy or gal in IT who moonlights as The Person Who Keeps Us From Doing Dumb Stuff. This is a part-time Cybersecurity Engineer (CSE) even if they don't call it that. There is no formal communication channel between leadership and the valiant part-time CSE. The disaster-recovery aspect of the job is folded into the system administration duties. Medium-Sized Organizations In medium-sized organizations you have a CSP with a few people in it, mostly refugees from IT who Secure The Network. This is often a supervisor and two helpers who sort of communicate with senior management on an ad hoc basi...

This is not the first or last time we will address the (alleged, purported, actual, imagined) demise of the entry-level job. That newbie fresh-out-of-college or right-out-of-the-military cyber-defender that had all the certs and none of the savvy? You might kiss it goodbye.  But in reality you're kissing that position description goodbye, not the role.  In brief we at Pythia Cyber think the nature of entry-level cybersecurity work will change but not disappear. Like any change process, its trajectory of change is unknowable; 5 years from now we will have a new labor force that arose from pressures we have now. Over at The Signal , Alex Banks is having all of the angst. These three nonconsecutive paragraphs tell his story: Nobody learns their trade in their first year. If you’re honest about your own, what you actually learn is a collection of many small micro-experiences that compound into a long list of intangibles that can rarely be named yet can only be sharpened through ...

Every security team has one: the analyst who triages faster than anyone else, the engineer who reads a packet capture like a second language, the threat hunter whose instincts catch what the tooling misses. When a leadership slot opens up, that person is the obvious pick. They're the strongest performer on the team. They are also, disproportionately, a bad bet for the management role, a specific kind of risk most security organizations aren't measuring. The reason is more precise than "not everyone is management material." Performance and potential are different psychological constructs, predicting different outcomes, and most security talent pipelines quietly collapse them into one. Here are five key points for you to remember in your review of performance v. potential. First point: climbing is not the same skill set as performing . Advancing in an organization and performing at higher/management levels draw on overlapping but distinct profiles. The people who get no...

You have a performance review cycle for your SOC analysts. Goals, check-ins, regular conversations about what's working and what isn't. When someone stops performing, you notice, you document it, and eventually you do something about it. When did you last have that conversation about your AI agents? You're not alone if your honest answer is "never." If performance conversations with your human cyber-defenders already make you feel like it's time for a major medical procedure without enough anesthesia, adding one more with an agent sounds like the last thing you need. In a recent McKinsey Talks Talent episode, Kate Smaje put it plainly: most organizations can't recall the last time they prioritized a conversation about the performance of their nonhuman labor. We've built decades of infrastructure for managing human performance. For agents, most companies have nothing. That gap should worry a CISO more than almost anyone else in the building. Smaje make...

Brendan has written a lot lately on cybersecurity as risk management. Another person in your organization who manages risk is the Chief Financial Officer (CFO). Is there any ovelap? Your CFO is supposed to keep the company's books straight and tell the board when something doesn't add up. Now imagine telling that same CFO: also, go adopt the new accounting software company-wide, use it yourself for the close, and be the one who catches it when it's wrong. That's roughly the position CFOs are in with AI according to Deloitte's Q2 2026 CFO Signals survey . More than half of CFOs are using AI for financial planning and budgeting. Forty-one percent use it to analyze financial data. Yet only 43% say they're very confident in their organization's AI governance framework. Most land at "somewhat confident," which is a polite way of saying "we haven't stress-tested this," which is even more polite than "I have no idea." As a CISO you...

At Pythia Cyber we keep bumping into managers and leaders who are surprised to hear that cybersecurity (C/S) isn't an IT function. After we explain how C/S isn't an IT function , they often ask "then why it is always presented to us as an IT function?" The answer is pretty simple: because most explanations use the bottom up approach. Those explanations work backwards from foiling an on-going cyberattack by showing an evil hacker in his lair and contrasting that with our heroes at their desks, heroically typing away to thwart evil in real-time. This image is ridiculous but in an understandable way: this image is visual, which suits film and TV. This image compresses the time-scale, which suits film and TV. This image gives us a nice symmetry of evil versus good. Of course this image is grossly simplified, as so many images are. We show teaching as the act of standing up in front of a class and talking or writing on the whiteboard. Anyone who has ever known a teacher kn...

At Pythia Cyber we keep bumping into managers and leaders who are surprised to hear that cybersecurity (C/S) isn't an IT function. At least they pretend to be surprised. We suspect that they really want  C/S to be an IT function because then they  wouldn't have to take any responsibility for it. As we have written about before, part of this reluctance to embrace C/S comes from fear of the unknown: most managers and leaders are quite familiar with accounting, marketing, sales, legal and HR. They are not familiar with C/S. Part of this reluctance comes from fear of the scary way in which C/S is presented, as an arcane dark technological enterprise marrying crime and science. Hooded figures in the dark type away on black keyboards, surrounded by so many monitors, all of which have green text on a black background. As we will see in a subsequent post, this image is the result of laziness and fatigue. In this post we will give a counter example that any business person can understa...