# Risk and Cyber Risk and Cyber This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Cybersecurity Benchmarking: Why, Why Not, When and How DevFeed: [Cybersecurity Benchmarking: Why, Why Not, When and How]() Original publisher: [Read original article]() Author: Phil Venables Published: 2026-09-05T15:27:39Z Content type: opinion Language: en Sources: [Risk and Cyber]() Topics: [benchmarking](), [Cybersecurity]() Tags: [benchmarking](), [cybersecurity](), [performance](), [risk]() ### AI overview The article argues that cybersecurity benchmarking is unhelpful when it focuses only on inputs such as budgets instead of outcomes such as control effectiveness. It recommends comparing leading indicators and examining how they influence lagging performance indicators, while noting that budget comparisons may not be meaningfully comparable. ### Source excerpt tl;dr Benchmarking is a waste of time when focused solely on inputs (e.g. budgets) rather than outcomes (e.g. effectiveness of controls). The budget comparisons are never "apples for apples" and may often end up setting risk tolerance only marginally ahead of others who may be in a bad state to begin with. Instead, we need to decouple this and compare leading not lagging indicators of performance to show (i) how those leading indicators drive the lagging indicators in the right direction and... ## Rolling with the Punches: Why Cybersecurity is Backgammon, Not Chess DevFeed: [Rolling with the Punches: Why Cybersecurity is Backgammon, Not Chess]() Original publisher: [Read original article]() Author: phil7672 Published: 2026-08-22T16:49:47Z Content type: opinion Language: en Sources: [Risk and Cyber]() Topics: [Cybersecurity](), [benchmarking](), [Vulnerabilities](), [Threat Research]() Tags: [benchmarking](), [cybersecurity](), [leadership](), [risk](), [vulnerabilities](), [zero-day]() ### AI overview The article argues that cybersecurity is better understood as backgammon than chess because organizations must prepare for many possible outcomes amid complex dependencies, supply chains, changing technology platforms, and unpredictable attackers. It also argues that cybersecurity benchmarking should focus on control effectiveness and outcomes rather than inputs such as budgets. ### Source excerpt It is tempting to compare cybersecurity to a chess game. Two adversaries facing each other, plotting strategy and tactics. Move and counter move, anticipating actions and grinding out a win. In reality, in our complex world of dependencies, supply chains, constantly shifting technology platforms and unpredictable attackers, this is all way more haphazard. Indeed, a better analogy is backgammon, where you position yourself for many different possible outcomes to maximize your chance of... ## Whether Rising Vulnerabilities Will Cause a Cybersecurity Incident Crisis DevFeed: [Whether Rising Vulnerabilities Will Cause a Cybersecurity Incident Crisis]() Original publisher: [Read original article]() Author: phil7672 Published: 2026-08-08T14:58:15Z Content type: article Language: en Sources: [Risk and Cyber]() Topics: [incident](), [Vulnerabilities](), [Cybersecurity]() Tags: [cybersecurity](), [incident](), [leadership](), [risk](), [vulnerabilities](), [zero-day]() ### AI overview The article examines whether increasing software vulnerabilities will lead to more cybersecurity incidents. It argues that security breaches often result from ineffective controls rather than exceptionally capable attackers or sophisticated zero-day exploits, and that benchmarking should focus on control effectiveness instead of inputs such as budgets. ### Source excerpt We're all talking about the tidal wave of vulnerabilities that is upon us, with repeated waves likely coming. As I've covered here, we can respond to this in various ways including ramping up speed across our entire defensive stack, which is as much about structural defense-in-depth than just faster patching. I've covered that here as well. But, there's a question as to whether the leading indicator of increasing vulnerabilities will in fact result in an increase in the lagging indicator of... ## Control Reliability Engineering (CRE): Applying SRE Principles to Cybersecurity Controls DevFeed: [Control Reliability Engineering (CRE): Applying SRE Principles to Cybersecurity Controls]() Original publisher: [Read original article]() Author: phil7672 Published: 2026-07-25T05:52:21Z Content type: article Language: en Sources: [Risk and Cyber]() Topics: [Cybersecurity](), [SRE](), [Monitoring](), [reliability](), [plotting]() Tags: [benchmarking](), [cybersecurity](), [leadership](), [monitoring](), [reliability](), [reliability-engineering](), [risk](), [sre](), [technology]() ### AI overview This article applies SRE principles to cybersecurity controls, arguing that control effectiveness matters more than input-focused budget comparisons. It highlights continuous control monitoring to detect controls that are broken, misconfigured, or incomplete when needed. ### Source excerpt Security breaches are often not the result of awesome attacker capabilities or the sudden emergence of sophisticated zero-day exploits. Instead, what we usually find are the controls designed to stop the attack were believed to be operational but were actually broken or misconfigured at the moment when they were needed. Sometimes they were never fully in place to meet the security team's original intent. So, continuous control monitoring is needed to counter the natural decay that occurs to... ## Technology Waves and Security - Is This Time Really Different? DevFeed: [Technology Waves and Security - Is This Time Really Different?]() Original publisher: [Read original article]() Author: phil7672 Published: 2026-07-11T15:52:48Z Content type: opinion Language: en Sources: [Risk and Cyber]() Topics: [Security](), [Vulnerabilities](), [Architecture & Design]() Tags: [architectures](), [cybersecurity](), [leadership](), [security](), [technology](), [transformation](), [vulnerabilities]() ### AI overview This commentary examines whether current technology waves are fundamentally different for security. It argues that benchmarking should focus on control effectiveness and outcomes rather than budgets, while discussing recurring waves of vulnerabilities and possible responses including increased speed. ### Source excerpt Most people have been through at least one wave of technology transformation. Some of us have been through a few and all carry the wisdom and scars from these. When you've experienced these changes you learn to appreciate, as the adage goes, that history might not repeat but it certainly does rhyme. In my working lifetime I caught the tail end of the mainframe to PC transition, the proliferation of client/server and distributed system architectures, wide-spread Internet adoption, mobile... ## Cybersecurity Benchmarking Should Focus on Control Effectiveness, Not Budgets DevFeed: [Cybersecurity Benchmarking Should Focus on Control Effectiveness, Not Budgets]() Original publisher: [Read original article]() Author: Phil Venables Published: 2026-06-27T12:52:02Z Content type: opinion Language: en Sources: [Risk and Cyber]() Topics: [benchmarking](), [Cybersecurity](), [Security & Privacy]() Tags: [benchmarking](), [cybersecurity](), [leadership](), [risk](), [security]() ### AI overview The article argues that cybersecurity benchmarking should assess the effectiveness of security controls and their outcomes rather than compare budgets, which are not reliably comparable. It also places cybersecurity work within the broader responsibilities shared by organizational functions. ### Source excerpt There's still a bit of a tone in some security circles that we're somehow unique in constantly having to push back against ill-advised moves, or even outright craziness, from our business, operations, or technology colleagues. But, when you pause and think about all the many functions in your or other organizations you realize this is not so. You quickly see that while great security teams are true enablers of business and reducers of friction, most teams still have to (and are expected to... ## CISO Version 2.0 DevFeed: [CISO Version 2.0]() Original publisher: [Read original article]() Author: Phil Venables Published: 2026-06-12T13:05:15Z Content type: opinion Language: en Sources: [Risk and Cyber]() Topics: [version](), [Security](), [benchmarking](), [Vulnerabilities]() Tags: [benchmarking](), [cybersecurity](), [leadership](), [opinion](), [risk](), [security](), [technology](), [version](), [vulnerabilities]() ### AI overview The article argues that the CISO role has evolved from an IT security manager into roles including cyber-defense leader, compliance director, and technology risk manager. It also argues that cybersecurity benchmarking is unhelpful when it focuses on inputs such as budgets rather than control effectiveness. ### Source excerpt Everyone, no doubt, has an opinion on how many versions of the CISO role we have gone through since its inception. There has been a constant evolution from what was essentially an IT security manager, to cyber-defense leader, compliance director, technology risk manager, and beyond. However, I would argue the incarnation of the CISO role up until recently has been CISO Version 1.0 albeit with some "point releases" on the way. This is simply because version 1 of the role is a mode where most... ## Why Cybersecurity Benchmarking Should Focus on Control Effectiveness and Outcomes DevFeed: [Why Cybersecurity Benchmarking Should Focus on Control Effectiveness and Outcomes]() Original publisher: [Read original article]() Author: phil7672 Published: 2026-05-16T15:56:56Z Content type: opinion Language: en Sources: [Risk and Cyber]() Topics: [benchmarking](), [Cybersecurity](), [Vulnerabilities]() Tags: [benchmarking](), [cybersecurity](), [effectiveness](), [leadership](), [risk](), [strategy](), [vulnerabilities]() ### AI overview This commentary argues that cybersecurity benchmarking should emphasize the effectiveness of security controls and outcomes rather than inputs such as budgets. It also discusses the continuing waves of vulnerabilities and possible responses. ### Source excerpt At some point every leader needs to ask themselves: Do I really know what is going on in my company? Do I even know what is really going on in my own organization? Most leaders do not know the actual truth of what is happening. This is not because people are overtly hiding things or that leaders are ineffective, although sometimes it is both of those, but rather this is because of the "thermocline of truth" that I covered in this post. Organizations are full of cultural, structural, process,... ## High Frequency Trading and Lessons for Agentic AI DevFeed: [High Frequency Trading and Lessons for Agentic AI]() Original publisher: [Read original article]() Author: Phil Venables Published: 2026-05-02T12:45:05Z Content type: opinion Language: en Sources: [Risk and Cyber]() Topics: [Artificial Intelligence](), [AI Strategy](), [systems](), [benchmarking]() Tags: [agentic-ai](), [agents](), [ai](), [automated](), [benchmarking](), [cybersecurity](), [financial](), [guardrails](), [risk]() ### AI overview The article argues that lessons from high-frequency and algorithmic trading controls can inform deterministic guardrails for mostly non-deterministic agentic AI systems as they evolve from chatbots into systems that act. It also argues that benchmarking should focus on outcomes such as control effectiveness rather than input budgets alone. ### Source excerpt I suspect I'm not the only former or current financial markets technologist that sees parallels between the world of high frequency / algorithmic trading controls and what is needed for appropriate deterministic guardrails around our, mostly, non-deterministic agentic AI systems. As we transition from chatbots to systems of agents, that don't just talk but act, we are entering a regime of automated risk that the financial markets have navigated, mostly successfully, for decades.... ## Maintenance of Everything : A Review DevFeed: [Maintenance of Everything : A Review]() Original publisher: [Read original article]() Author: Phil Venables Published: 2026-04-18T10:45:19Z Content type: opinion Language: en Sources: [Risk and Cyber]() Topics: [maintenance](), [risk-management](), [reliability](), [Security]() Tags: [cybersecurity](), [maintenance](), [reliability](), [review](), [risk-management](), [security](), [technology]() ### AI overview A review of Stewart Brand's book Maintenance of Everything, discussing the importance of maintenance in technology risk management, security, and reliability. It also questions cybersecurity benchmarking that focuses on inputs such as budgets instead of outcomes such as control effectiveness. ### Source excerpt I haven't done a book review for a while and there's no better way to get back to this than a look at Stewart Brand's Maintenance of Everything . Stewart developed a lot of this book in an open editing process and so the final delivery of what is Part 1 of a forthcoming series was all the more anticipated. I've long been obsessed with the need for maintenance in the context of technology risk management, security and reliability. A big part of technical debt build up and the security... ## The Real Role of the Field CISO DevFeed: [The Real Role of the Field CISO]() Original publisher: [Read original article]() Author: phil7672 Published: 2026-04-04T13:32:43Z Content type: article Language: en Sources: [Risk and Cyber]() Topics: [Security](), [reliability](), [Security & Privacy]() Tags: [ciso](), [cybersecurity](), [leadership](), [reliability](), [security]() ### AI overview The article discusses the role of Field CISOs and argues that security and reliability increasingly support sustainable, long-term customer success. ### Source excerpt We all need to advance our businesses and that is in many respects about selling. We also need to recognize that security and reliability are increasingly the path to sustainable long term customer success - which is your success. This is where the Field CISOs come in. There are many more people that are becoming, so called, Field CISOs and many more organizations that are creating Field CISO teams under a variety of structures and names. Let's look at what Field CISOs are, why they exist,... ## Organizational Politics & The Security Program DevFeed: [Organizational Politics & The Security Program]() Original publisher: [Read original article]() Author: phil7672 Published: 2026-03-21T11:29:27Z Content type: opinion Language: en Sources: [Risk and Cyber]() Topics: [Security](), [Threat Research]() Tags: [cybersecurity](), [leadership](), [risk](), [security](), [technology](), [vulnerabilities]() ### AI overview The article revisits organizational politics in security programs and argues that cybersecurity benchmarking should focus on control effectiveness and outcomes rather than budgets alone. It also discusses the continuing waves of vulnerabilities and possible responses. ### Source excerpt I first wrote the original of this post over 4 years ago. Having seen a new spurt of discussion about organization politics in various on-line and in-person forums I thought it was time for an update. At every stage in your career and in every part of your role you are going to have to deal with organizational politics. People often construe such politics as inherently negative. Yes, there are some organizations that have toxic cultures where organizational politics looks more like chicanery... ## Cybersecurity's Need for Speed & Where To Find It DevFeed: [Cybersecurity's Need for Speed & Where To Find It]() Original publisher: [Read original article]() Author: phil7672 Published: 2026-03-07T15:08:59Z Content type: opinion Language: en Sources: [Risk and Cyber]() Topics: [Cybersecurity](), [Security](), [Vulnerabilities](), [benchmarking]() Tags: [benchmarking](), [cybersecurity](), [risk](), [security](), [vulnerabilities]() ### AI overview The article argues that cybersecurity organizations should increase their speed in adapting to change and responding to evolving threats. It also argues that cybersecurity benchmarking should focus on control effectiveness and outcomes rather than inputs such as budgets. ### Source excerpt As we talked about in the last post , a world going through a massive AI-driven transition means speed becomes vital. This is the speed of adapting to change and the speed of dealing with a world of threats, who are themselves moving ever faster. It's easy to say go faster but this has to be more than just wishful thinking or a line in a strategy document. You actually have to go do some things. You also have to push back against some of the defeatism that permeates a lot of the security... ## AI Is Reorienting Cybersecurity and Increasing Its Negative Impact DevFeed: [AI Is Reorienting Cybersecurity and Increasing Its Negative Impact]() Original publisher: [Read original article]() Author: Phil Venables Published: 2026-02-21T16:08:46Z Content type: opinion Language: en Sources: [Risk and Cyber]() Topics: [Artificial Intelligence](), [Security](), [Cybersecurity]() Tags: [ai](), [cybersecurity](), [risk](), [security](), [technology]() ### AI overview The article argues that AI is rapidly reshaping cybersecurity and may have a more negative impact than previously assumed. It also questions cybersecurity benchmarking based only on inputs such as budgets rather than outcomes such as control effectiveness. ### Source excerpt It's not often that a force appears that totally re-orients everything in security. This is what we are facing with AI. 12 months ago I had an incrementalist view of the cybersecurity impact of AI. Specifically, that it will be very significant but things will change progressively and we'll adapt to adversarial use while also using it to improve defenses. Now, I'm coming to a view that this will have a bigger negative impact than even our worst assumptions. But at the same time, it... ## Security Implications of DORA AI Capabilities Model DevFeed: [Security Implications of DORA AI Capabilities Model]() Original publisher: [Read original article]() Author: phil7672 Published: 2026-02-07T13:23:17Z Content type: opinion Language: en Sources: [Risk and Cyber]() Topics: [Artificial Intelligence](), [Security](), [Access Control](), [data]() Tags: [access-control](), [ai](), [cybersecurity](), [data](), [security](), [technology]() ### AI overview This opinion article summarizes security implications identified in the DORA AI Capabilities Model, focusing on data protection, access control, and evaluating cybersecurity controls by their effectiveness rather than by budget alone. ### Source excerpt The DORA AI Capabilities Model (DevOps Research and Asssesment, not the EU Digital Operational Resilience Act) report is well worth a read not just to get a perspective from the developer community but to look at the many security implications it uncovers. This post is a summary of the explicit findings and some of broader implications from reading between the lines of the report. 1. Data Protection and Access Control A primary security concern is ensuring AI tools respect existing... ## The CISO's Craft: Watchmaker or Gardener? DevFeed: [The CISO's Craft: Watchmaker or Gardener?]() Original publisher: [Read original article]() Author: Phil Venables Published: 2026-01-24T16:39:53Z Content type: opinion Language: en Sources: [Risk and Cyber]() Topics: [Security](), [Cybersecurity]() Tags: [ciso](), [craft](), [cybersecurity](), [leadership](), [precision](), [security]() ### AI overview The article considers whether security leaders should operate more like precise watchmakers, adaptive gardeners, or both when leading organizational transformations. It also argues that cybersecurity benchmarking should focus on control effectiveness and outcomes rather than inputs such as budgets. ### Source excerpt Some time ago I saw a comment about the distinction between acting like a "watchmaker" or a "gardener" when undertaking organization transformations. I misplaced the original reference so, unfortunately, I can't credit appropriately. But, I've been thinking a lot about what this would mean in the context of security leadership. Specifically, should the CISO be a watchmaker or a gardener, or both? The Watchmaker CISO: Precision and Control Imagine a master watchmaker, meticulously crafting... ## 2025 Year in Review - Top 10 DevFeed: [2025 Year in Review - Top 10]() Original publisher: [Read original article]() Author: Phil Venables Published: 2026-01-10T14:36:22Z Content type: opinion Language: en Sources: [Risk and Cyber]() Topics: [Cybersecurity](), [Architecture & Design](), [Detection engineering](), [Vulnerabilities]() Tags: [2025](), [benchmarking](), [cybersecurity](), [execution](), [leadership](), [risk](), [technology](), [transformation](), [vulnerabilities](), [year-in-review]() ### AI overview A 2025 year-in-review highlighting posts about cybersecurity as a business leadership, strategic design, and sustainable execution function. It emphasizes moving from reactive security practices toward scalable, proactive systems and cautions against benchmarking based only on inputs such as budgets rather than control effectiveness. ### Source excerpt The most read posts in 2025 coalesced around the concept that successful cybersecurity is fundamentally a function of business leadership, strategic design, and sustainable execution . The unifying themes across the top posts emphasize shifting security from an artisanal, reactive craft to an industrial-scale, proactive capability focused on building scalable, self-reinforcing systems (flywheels). Transformation requires leaders to manage stakeholder expectations carefully, particularly by... ## Security Leadership Master Class 7 : Contrarian takes DevFeed: [Security Leadership Master Class 7 : Contrarian takes]() Original publisher: [Read original article]() Author: Phil Venables Published: 2025-12-27T15:12:43Z Content type: article Language: en Sources: [Risk and Cyber]() Topics: [Security](), [benchmarking](), [High Profile Threats](), [Vulnerabilities]() Tags: [benchmarking](), [cybersecurity](), [leadership](), [security](), [vulnerabilities]() ### AI overview The article's final installment discusses contrarian perspectives on security leadership, arguing that cybersecurity benchmarking should focus on control effectiveness and outcomes rather than inputs such as budgets. It also considers adversarial strategy and responses to recurring waves of vulnerabilities. ### Source excerpt This is the final of the series grouping together sets of prior posts into a particular theme. Security Leadership Master Class 1 : Leveling up your leadership Security Leadership Master Class 2 : Dealing with the board and other executives Security Leadership Master Class 3 : Building a security program Security Leadership Master Class 4 : Enhancing/refreshing a security program Security Leadership Master Class 5 : Getting hired and doing hiring Security Leadership Master Class 6 : When... ## Security Leadership Master Class 6 : When disaster strikes DevFeed: [Security Leadership Master Class 6 : When disaster strikes]() Original publisher: [Read original article]() Author: Phil Venables Published: 2025-12-13T16:15:34Z Content type: article Language: en Sources: [Risk and Cyber]() Topics: [benchmarking](), [Cybersecurity](), [Vulnerabilities]() Tags: [benchmarking](), [cybersecurity](), [leadership](), [vulnerabilities]() ### AI overview Part 6 of a security leadership series argues that cybersecurity benchmarking should focus on outcomes, such as control effectiveness, rather than inputs such as budgets. It also discusses responding to recurring waves of vulnerabilities. ### Source excerpt This is part 6 of a 7 part series grouping together sets of prior posts into a particular theme. Security Leadership Master Class 1 : Leveling up your leadership Security Leadership Master Class 2 : Dealing with the board and other executives Security Leadership Master Class 3 : Building a security program Security Leadership Master Class 4 : Enhancing/refreshing a security program Security Leadership Master Class 5 : Getting hired and doing hiring Security Leadership Master Class 6 : When...