Insights
Field notes
Written from running the work, not from a content calendar.
FEATUREDMONITORING5 MIN
What continuous monitoring actually catches
Between the annual questionnaire and the incident, there is a year of change nobody is watching.
COMPLIANCE4 MIN
Map once, answer many
Why control mapping beats answering the same question in six different formats.
SCORING3 MIN
A risk score you can defend
What has to be true before a composite number is worth putting in front of a board.
PRACTICE5 MIN
A third-party risk program in 30 days
The order of operations that gets a working program stood up in a month.
REPORTING4 MIN
Board reporting without the rebuild
How to hand the board a pack that came from live data rather than a copy-paste marathon.
ASSESSMENTS4 MIN
Why vendors do not answer your questionnaire
The response-rate problem is a design problem, and it is fixable.
CONCENTRATION4 MIN
Fourth-party risk is concentration risk
Your suppliers share suppliers. That is where the correlated failure lives.