Notes on doing GRC deliberately.

Essays and short notes on strategy, risk, smart compliance, and the AI questions security teams actually have to answer.

May 2026 The DBIR 2026: three findings that deserve immediate attention Vulnerabilities overtake credentials as the top initial access vector, third-party involvement doubles again, and AI's first impact is industrialization — not innovation. Essay · 7 min → May 2026 From heat maps to decisions Heatmaps destroy the information your security stack is already generating. The fix is Decision Quality, three data sources, and a curve instead of a colour. Companion to my V2 Security 2026 talk. Essay · 8 min → Apr 2026 The timeline is collapsing faster than defenses can adapt Median time-to-exploit dropped from 771 days in 2018 to under 1 day in 2026 — AI removed the compute bottleneck. Five moves defenders should make now. Essay · 5 min →