top of page


Compliance Is Not Security: When Governance, Risk, and Compliance Fail to Protect
In cybersecurity, compliance is often mistaken for protection. Unfortunately, that decision trades measurable comfort for invisible risk.
Andrew Kirch
Oct 216 min read
Â
Â


SaaS vs On-Prem: Cybersecurity Risks to Continuity, Integrity, and Access
Many organizations rely on SaaS platforms instead of traditional on-premises solutions, trading control for convenience. The risks of that trade-off are often misunderstood.
Andrew Kirch
Sep 234 min read
Â
Â


Executive Missteps: Fire Drill Down Below
This is the fourth installment in an ongoing series called "Executive Missteps" on how business leaders, often unknowingly, sabotage their organization's cybersecurity...and how not to be that person. Each is inspired by a true story (or several). Find previous installments here: Above the Law (1) , Shadow (IT) Man (2) , On Deadly Ground (3) . Avery (not his real name) is busy, like most CEOs. His company is a regional powerhouse in the process of building out a handful of

Susan Sons
Sep 164 min read
Â
Â


Failure Is Like Onions: Physical Security Lessons for Your Server Room
Stop me if you have heard this before. A company suffers a massive IT outage. The culprit is not a hacker in a foreign country or a sophisticated piece of malware. It is an unlocked door.
Andrew Kirch
Sep 75 min read
Â
Â


Executive Missteps: On Deadly Ground
This is the third installment in an ongoing series called "Executive Missteps" on how business leaders, often unknowingly, sabotage their organization's cybersecurity...and how not to be that person. Each is inspired by a true story (or several). Find the first installment here , and the second here . Cybersecurity risks brought in by M&A can leave an executive feeling like the ground is falling out from under them. It's been a busy month for our CEO as the company works on w

Susan Sons
Sep 25 min read
Â
Â


The Pitfalls of Cybersecurity Insurance and how your small business can avoid them
Most companies don’t realize how narrow and conditional cybersecurity insurance coverage really is until they need it.
Andrew Kirch
Aug 273 min read
Â
Â
Executive Missteps: Shadow (IT) Man
This is the second installment in an ongoing series called "Executive Missteps" on how business leaders, often unknowingly, sabotage their organization's cybersecurity...and how not to be that person. Each is inspired by a true story (or several). Find the first installment here . It's a normal Wednesday morning when the SOC (Security Operations Center) manager gets a knock on her door. One of her analysts has learned that the company's mail server has appeared on major bla

Susan Sons
Aug 53 min read
Â
Â


Executive Missteps: Above the Law
It's late on Friday afternoon, and the corporate help desk gets a phone call. The CEO is in a panic. His next move will cost the company dearly.

Susan Sons
Jul 224 min read
Â
Â


A Practical Guide to Ransomware recovery (without paying) and Data Loss Prevention
Protecting your business from ransomware and blackmail requires a disciplined backup and data loss prevention strategy.
Andrew Kirch
Jul 155 min read
Â
Â


Security and the FOSS Supply Chain
Learn how to evaluate the security risks of Free and Open Source Software (FOSS) vs commercial software. A practical framework for risk assessment and communicating findings to management.
Andrew Kirch
Jun 155 min read
Â
Â
bottom of page


