Do you want to be a better manager? Here is the third piece of advice in an occasional series. Remember, these processes are usually free and have high ROI. Ready? OK: Now discover your strengths and limitations . An inspection is not the time to be surprised, especially when you think something should be there and it's not.  Ask yourself, then: what do you expect when you review your logs, check your patches, or assess your system's functions?  Or, on the behavioral side, what about when you assess your candidates, review employee performance, or assess your team culture? If you have the same look as Mr. Alfozan in the picture above, you are like most managers and you probably have a talent issue -- both theirs and yours. Let's inspect the inspector. The four pillars of a successful cybersecurity team are hire for talent, build structure, create engagement, develop your people. Get those right and you're invincible. But too often managers are not invincible, despite k...

Human behavior is a huge part of cybersecurity, say I and everyone in the room nods sagely. But like Lake Woebegone, where all the children are above average, in Cybersecurity Culture we all seem to be immune to the foibles of the human psyche. What does that mean? An example will help. One of my buddies in college, JG, was an applied math major with a penchant for mechanical engineering courses. At a deep level these two fields are closely related. But they are not the same, especially with respect to the personality traits of the practitioners. This fact first came to my attention when JG joined other of my friends in taking a course entitled "Design Optimization and Failure." JG loved this course. He loved using Finite Element Analysis to figure out which part in a complex system would fail first, which set the standard that all the other parts would be held to. He loved the head-spinning math required to constantly re-assess as they tried to make a complex system a bit st...

Our  previous post was about the Abundance Paradox in its many forms namely having lots of something turns out to have downsides in addition to upsides. My cup runneth over (and now the table is wet). That post was about cybersecurity (C/S) in general being vulnerable to this problem. This post is about how apply AI to C/S in particular has risks associated with it. Using AI to do your C/S survey work is very handy and allows you to keep up with lots of rote tasks but there are two downsides: the AI makes mistakes (fewer all the time, but still the occasional whopper) and relying on the AI means that your abilities atrophy or never develop in the first place. Is that a problem? After all, horse-handling is no longer a very common requirement of modern life. However, for years after the introduction of the automobile horse-handling remained quite a useful skill. The fact is that the set of skills you need over your life changes, faster than it ever has in human history, and our val...

This is so good that it deserves amplification. Since 2023, CISA -- the US Cybersecurity and Infrastructure Security Agency -- has pushed software manufacturers toward three secure-by-design commitments: take ownership of customer security outcomes, embrace radical transparency and accountability , and lead from the top . That last one matters more than its plain wording suggests. It puts security accountability on senior leadership, not just the engineers writing the code. More recently , CISA extended the same thinking to the 'buy side': a guide for software purchasers, with questions to ask vendors before you sign. That's the piece CISOs should actually be pinning up: security starting at procurement , not bolted on after deployment . How realistic is any of this? Jen Easterly, former Director of CISA, posted an announcement on LinkedIn that as of late September 2026 the State of Oregon is applying these principles in its own procurement practice . If a state governme...

Disruptions of US water infrastructure have been in the news recently, which made us think of utilities in general. Utilities in general (water, electricity, natural gas) are often targets of military hacking as opposed to criminal hacking, which made us think of how much we emphasize one (criminal) and minimize the other (military). Let's get into that. The model we are used to is cyber crime, almost always in the form of being held for ransom by ransomware. In this scenario your systems are breached, then compromised, then a ransom demand is made. There is nothing subtle or covert about this process. The goal is immediate attention and payment. You don't have to wonder if you are being attacked. You cannot avoid knowing that you are being attacked. The military model is very different. Your adversary wants to know what they can do to you, but unless you are actually at war your adversary may not want you to know that they know. There will be no alarm bells. There will be mini...

  Boards often hire CISOs to "prevent breaches and maintain compliance." In always-on security environments, that's the wrong job description . The real job is: "Build a team that learns faster than the threat landscape changes." That requires you, the Board, to engage in different hiring, different measurement, different patience, and different incentives. You don't want to incentivize the wrong behaviors, and you definitely don't want to repeat past mistakes with cybersecurity leadership. Here are two models that sound the same, but they incentivize almost opposite behaviors. The Prevention Model (what Boards usually want): Minimize incidents through defensive posture Follow best-in-class frameworks (NIST, ISO, etc.) Measure : "Did we get breached? Are we compliant?" Reward : Avoiding bad things Risk tolerance : Low The Learning Model (what the always-on security environment requires): Detect novel threats fast, respond faster, extract lesso...

I want to recommend this article to my fellow cybersecurity professionals: https://thehackernews.com/2026/07/thinking-fast-and-slow-in-soc-case-for.html It does a nice job laying out reasonable roles for AI (pattern-matching donkey work) and human co-pilots (distinguishing the abnormal from the malevolent). Since a big part of why Pythia Cyber exists is to get more people in management to see cybersecurity as part of their job, I am going to write the rest of this post as a way to explain this strategy by way of an analogy that is not based in cybersecurity. Once upon a time I consulted to the laboratory medicine department of a large academic medical center. A large clinical laboratory is not a monolith, it is a conglomeration of different focus areas such as Immunology, Hematology, Chemistry, Virology and some other more obscure areas. The goal was to interface automated analyzers to the Laboratory Information System (LIS), but not directly because it was common wisdom that a qualifi...

You may have been around for the bicentennial...maybe you'll be here for the tercentennial...but seize the semiquincentennial while you have it! (image credit: After Jasper Johns, Public domain, via Wikimedia Commons)

Today is a day in the US to celebrate the Emancipation Proclamation . The commemoration started in Texas because it took from 1 January 1863 until 19 June 1865 for the news to reach Texas that slaves were freed. Why that long? Because -- Texas. Also there was a war and Texas was a Rebel state, and there was no Internet. And DC is a long ways away from Galveston, TX where the news was announced. Here are two lessons to take from this holiday. First, all people are created equal. Sure, some are taller, some better at coding, others more empathetic or better-looking or more adept at poetry. But we're all equal.  "Buit wait!," you exclaim, "Isn't that what the Declaration of Independence says and not the Emancipation Proclamation?" We'll get to the DoI in a few weeks but think of it this way. The Declaration of Independence does indeed capture the novel idea that "We hold these truths to be self-evident, that all men are created equal, that they are en...

There is an old military pilot's saying that sky diving is like practicing bleeding. The point is that bleeding is unpleasant, often unavoidable and something that you can probably just figure out as you go along, so why worry about it before then? Except that you absolutely should not just figure it out as you go along. You absolutely should know basic first aid and have an idea of how to stop bleeding should it occur. Alas, this same attitude often makes a hard job harder: implementing your  NIST CSF  Respond Plan or Recover Plan in the face of an outage. And yes, this is another example of how behavioral science greatly improves cybersecurity. Human beings avoid negative stimuli and seek out positive stimuli. We all know this, but many of us pretend that this isn't true or worse, that it isn't true of us or our team . But it is true and if you don't actively make this work for you it will absolutely work against you. What does this have to do with cybersecurity, you...

We take a moment to note the death of Eric Cole, PhD. We found his writing about cybersecurity to be enlightening, inciteful, and thoughtful. RIP. (image credit: LinkedIn post)

Pythia Cyber is uniquely focused on the behavioral and organizational conditions that determine whether cybersecurity investments produce cybersecurity outcomes. We focus on cybersecurity talent at the engineer, manager, and leader levels, and on the culture and talent strategy that surround them. Brendan refers to this as TAU : the systems, processes, and talent implementation strategies that create cybersecurity. You can't hire your way to better cybersecurity if your systems, processes, and talent implementation strategies are inadequate and misaligned. You can't organize your way to cybersecurity through systems and processes that are under-executed by less-talented personnel, managers who can't connect with their teams and stakeholders, or leaders who can't lead. You need talent and you need a talent strategy. And you need the people running cybersecurity to be "bilingual." Cybersecurity leaders are translators by necessity. They face downward into the t...

In Dickens's A Christmas Carol  we are given one of the greatest metaphors of all time. When Scrooge is visited by the ghost of his old business partner, Jacob Marley, he finds that ghost trailing all things that Marley's greed goaded him into possessing: money boxes, transaction ledgers, pad locks and even heavy deeds. When Scrooge asks Marley where the chain came from, Marley's answer is chilling: I wear the chain I forged in life. I made it link by link, and yard by yard; I girded it on of my own free will. Believe it or not, this sprang to mind last week when I learned that current FBI directory Kash Patel had some of his personal emails leaked by enemies of the state. Iranians? Russians masquerading as Iranians? Iranians with Russian help? Who knows. The point is not specifically who did it. The point is not the rather banal and inane content. The point is not that the content was from a while ago. The point is that we all wear the digital chains we forge in life. We m...

I am a fan of sketchplanations.com  in general and this sketch in particular caught my eye for two reasons. First, I love me some hair-splitting (ask me about the difference between "virulent pathogens" and "infectious pathogens"). Second, this gives me a great way to talk about a big deal in cybersecurity. Before diving into that big deal I want to apply the point of the sketch to cybersecurity. The field of cybersecurity is a branch of Risk Management. The people running the organization have to set priorities and budgets. The people running the organization have to sign off on the policies which decide which risks are worth mitigating. The people running cybersecurity have to write procedures which implement those policies and then police activity to ensure that the procedures are active and effective. By analogy, the policies are accuracy: are you trying to protect what you need protected? The procedures are precision: are you effectively protecting whatever it ...

The United States of America has taken military action against the Islamic Republic of Iran. Unforeseen or unforeseeable? In the cybersecurity context, it doesn't really matter: either you were prepared for this or you were prepared for something like this or you have the talent and bandwidth to pivot or you are a cautionary tale waiting to happen. By "something like this" I mean the risk of cyber attacks from foreign operatives as opposed to criminals or vandals. Vandals are mostly thrill-seeking. Criminals want to get money. Operators want to either lurk or disable your systems. Vandals are often as unsophisticated in their thinking as they are sophisticated in their hacking. It has been a long time since they were the top threat. Just keep your defenses up-to-date and your monitoring current and you should be able to keep them out. Criminals are getting every more sophisticated in their scams and their use of stolen information. But they don't want to get caught an...

When you as a cyber-professional think of planning for war, you probably have in mind some order of battle map such as the one above. It shows the front lines, terrain, forces in opposition, troop movements, etc.  Your thought process is wrong. And, when you as a cyber-professional think of war you probably think of engaging with the enemy and taking and holding territory, or bombing, or drones and missiles. Well that thought process is wrong too.  But you're in a war anyway. How is it going for you? War is serious business and cyber-warfare is not like other wars, especially when you're almost always on defense at all times. All of us have models, scripts, or even memories based on experience and education for endeavors such as wars. These models and scripts come from family lore, movies, books, military service, and so on. They are all valid as far as that goes. Problem is, you're in a cyber-war and you don't have a model or script, probably not even personal experien...

Recently the topic of "Zero Trust" as a cybersecurity paradigm came up. This is a simple-seeming question which requires some context because a simple definition isn't really going to help you much. Here is the simple definition: Zero Trust is a cybersecurity paradigm whose motto is  Never trust, always verify. This motto is snappy and short and clear at the high level. But once you try to imagine how you would implement this paradigm there are many questions, starting with "what's the practical definition of 'cybersecurity paradigm'"? Your cybersecurity paradigm is your fundamental approach to cybersecurity. It underlies everything you do to maximize authorized access to your cyber resources while minimizing unauthorized access. It is usually so deeply ingrained and so pervasive that you aren't even aware of it. The most common cybersecurity paradigm we see is The Perimeter Paradigm: you build a virtual castle around your cyber resources and the...

As the bible-inspired old saw goes, it is foolish man who builds his house on a foundation of sand. Assume that he has a choice, of course. Google's AI, ever helpful and knowing that I am interested in cybersecurity topics, sent me a link recently with this rather ominous opening paragraph: In early 2026, cybersecurity leadersare grappling with a critical disconnect between the frequency of third-party security incidents and their internal capacity to manage them. According to a comprehensive  2026 survey of 200 US-based CISOs, while 60% of organizations reported an increase in third-party breaches, a staggering 85% admitted they lack full visibility into their software supply chain risks. [ source ] This is fancy way of saying that we all take on the cybersecurity vulnerabilities of our business partners and suppliers, at least to some degree. The "lack full visibility into their software supply chain risks" is a bit dramatic: of course we do. It is not realistic to expe...

Note : the picture is from the OSMEGEOS exhibit at the Hirschhorn Museum and Sculpture Garden exhibit in Washington, DC, July 2025. In May and then June we covered the  litany of the hacked , a group of entities that had been successfully hacked. The point of these litany posts is to note that this sort of thing happens and it has consequences. Pretending that you can whistle past the graveyard in cyberspace is foolish and delusional. And so, the litany of the hacked, July 2025 edition. The litany now includes: Aeroflot Airlines...Qantas Airlines...Allianz Re insurance...Rogers Communications...Tea (women-member-only date-rating site)...Elmo's account on the platform X...Microsoft's SharePoint servers... McDonald's  hiring  process assistant chatbot...CoinDCX crypto exchange...maybe the government of Singapore...City of St Paul, MN...pharmacies in Moscow, Russia... These different hacks had different purposes. Getting a Sesame Street character to spout anti-Semitism and ...

Some things in artificial intelligence (AI) that people ohh & aahh about include the use of AI to create fake videos, write research papers, fly fighter jets, perform surgery , act as 'digital twins,' and otherwise do things that we thought only skilled sentient beings could do. That's amazing because after all AI is math, it can't prefer to do some things instead of others, and it has no way to want to do things -- it just does them. These creative uses of agentic robot features have made an impression on gangs using AI agents to engage in deception to attack cybersecurity systems.  At a very low level of a deception-based attack, the AI mimics the characteristics of a known/trusted individual and seeks access to systems that the known/trusted person should have. That's what  this post  is about.  Now, of course we've always had deception. That's the whole point of the term " Trojan horse ." That's how Lucifer breaks out of hell in the epi...