Thinking About the Security Program in Relation to Business and IT
One thing I often miss in security is to see the relationship between the security program x business and the security program x IT. Currently, … Read More
Thinking About the Security Program Maturity and Effectiveness Level Versus the Target Level
I think we need to think more specifically and explicitly about security program maturity and effectiveness. So how does that work? This diagram highlights the … Read More
CISO Security Mind Map 2026
We’ve updated the CISO Security Mind Map for 2026, continuing in the yearly updates since 2023. Here it is (click to magnify): The top challenges … Read More
The Biggest Shifts in OWASP Top 10 2025
This article discusses the OWASP Top 10 2025 update. There’s a hard truth that usually shows up after a few years of production work, or … Read More
CIS Critical Security Controls (or CIS Controls): An Analysis and Overview of the 18 Controls
In this article we look at the CIS Critical Security Controls (CIS controls), and how they can help to provide security focus for your company … Read More
Threat Modeling the FIA Driver Categorization Application that Allowed Unauthorized Access to Max Verstappen’s Passport and PII
Ian Carroll, Sam Curry, Gal Nagli published an interesting article about their ethical hacking of the FIA Driver Categorization application. They identified a weakness which … Read More
CISO Security Mind Map 2025
Newer CISO Security Mind Map 2026 version is available! We’ve created the CISO Security Mind Map 2025. It’s an update from the previous year. You … Read More
Microsoft Security Development Lifecycle (SDL)
Learn how Microsoft’s Security Development Lifecycle (SDL) can help protect your software from cyber threats. Discover best practices and implementation tips.
Threat Modeling within DevSecOps
Learn how to incorporate threat modeling into your DevSecOps practices to enhance security and protect against potential cyber threats.
NIST Cybersecurity Framework 2.0
Learn about the updates and improvements in the NIST Cybersecurity Framework 2. Enhance your cybersecurity strategy with the latest guidelines.