Learn
Essays on cyber risk, controls, evidence, and consequence.
Sixteen essays on what changes security outcomes: control state, drift, remediation, proof, leadership, insurance, third-party risk, and the conditions that accumulate before an incident.
Systems and pressure
How risk moves
Drift, time, exposure, evidence, and the difference between seeing a cybersecurity problem and changing the outcome.
Security Is a Physics Problem, Not a Policy Problem
Why policies do not hold a system stable on their own.
The Shape of Risk
Why cyber risk has boundaries, direction, concentrations, and paths rather than one permanent scalar value.
Risk Moves Before the Incident
The conditions behind an incident usually change before the event is visible.
Drift Is What Happens Between Reviews
Why yesterday's verified state cannot simply be assumed today.
A Dashboard Does Not Change the System
Seeing a problem is different from correcting it.
Evidence Should Accumulate While You Operate
Why evidence is stronger when it exists as the work happens.
Most Breaches Have a Long Runway
How ordinary unresolved conditions can remain useful to an attacker for months.
People, process, and control
How organizations fail
The gap between documented process and what is happening in the environment under real operating pressure.
Compliance Under Operating Pressure
The gap between documented process and operating reality.
Visibility Is Not Control
Monitoring explains what is happening; control changes what can happen next.
Detection and Prevention Are Different Jobs
Why alerts are not the same thing as stopping or correcting the problem.
Evidence Built After the Fact Is Weaker Evidence
Why reconstructing proof later is slower, harder, and easier to challenge.
Most Security Tools Stop at Notification
What is missing when a tool can report a problem but cannot close the loop.
Boards, insurance, and liability
Where cybersecurity becomes a business decision
Boards, underwriting, third-party risk, claims, and the cost of proving security after the pressure arrives.
Cyber Insurance Is Becoming an Operating Test
Why underwriting and claims increasingly test the control claims organizations make.
The Board Needs Better Cyber Questions
Why operating state and recovery matter more than a tour of security products.
Third-Party Risk Is Not a Questionnaire Problem
Why a completed vendor review cannot hold a supplier's security state in place.
The Cost of Reconstructing Proof After the Fact
What retrospective evidence assembly costs when the pressure is highest.
VitalSec connection
The essays explain the problems. VitalSec handles the work.
VitalSec uses a six-stage control loop: Observe → Decide → Act → Validate → Prove → Measure. The essays explain why drift, timing, evidence quality, remediation, and consequence matter at each stage.