Articles

Short, opinionated, and written for organizations where one team — or one person — carries IT, security, and compliance at once.

Foundations: the 80/20 series

The Pareto principle applied to SMB security: a vital few controls eliminate most breach risk — and the breach data proves it.

Each control as a step-by-step playbook — owner, effort, pitfalls, an explicit "done means," and the evidence that proves it.

Week-by-week phases, ownership, the weekly 25 minutes, three leadership decisions — and an interactive checklist that tracks it all.

Coverage metrics, not activity metrics: the five numbers that detect erosion, and the one-hour review that keeps them green.

Ten models behind better prioritization, honest risk judgment, and a program that doesn't fool itself — with Decision Lab references to go deeper.

NIST CSF, ISO 27001, SOC 2, CMMC, CIS — they're 70% the same controls. Pick by who's asking, build once, map many.

The three-sentence rule, calendar-language likelihood, and why documented risk acceptance is your best friend.

The three-bucket model, the calendar as a compliance control, what to outsource — and how to say no with a number.

Ghost licenses, duplicate tools, tier mismatches, and shelfware. The audit that funds your next security project.

Defaults optimize for adoption, not protection. The ordered list that closes the gaps attackers actually use.