Why I Don't Like Cybersecurity Awareness Month
If your security plan expires on November 1, it isn't a plan. It's a seasonal flavor.
blog
You Don't Have To Say Everything, To Everyone All At Once
A product may have ten important features, but that does not mean every communication needs to explain all ten. The job of marketing is to establish quickly why the target audience should be interested in the product, and move them to the next stage.
CruiseCon AI & Privacy 2026: Ship's Log (A.K.A. Racing Isaias)
Bill Brenner posts regular updates from abourd the Mariner of the Seas cruise ship, where he is covering the proceedings during CruiseCon 2026
When the Platform Can Say No Without Saying Why
No externally governed inference or action provider should constitute an unmitigated single point of failure. Where provider behavior cannot be sufficiently characterized, treat the provider as an untrusted-availability dependency.
Nonprofit Cybersecurity Won’t Be Fixed With Another Checklist
Nonprofit cybersecurity doesn't improve with more checklists and portals. Real change starts with conversations that expose hidden risks, build trust and turn advice into action.
Stop Chasing Reach: Why Niche Influence Matters More in Cybersecurity
As a cybersecurity start-up or scale-up you don't need everybody to know your name. You need the right people to keep encountering it for the right reasons.
AI and Nonprofits: The Monster Under the Bed Uses the Same Old Doors
AI is changing the threat landscape. For nonprofits and other under-resourced organizations, panic is a bigger risk than the technology.
Airport Chaos Exposes Confocal Infrastructural Vulnerabilities
A severed FAA communications line grounded flights across the Northeast, exposing the dangers of confocal infrastructural vulnerabilities. Why physical redundancy matters and how a single point of failure can cripple critical infrastructure.
These Booths Are Made For Walking
More OT, less governance: reflections on the CYBR.SEC.CON. 2026 show floor
Observations from CYBR.SEC.CON. 2026
Winn Schwartau shares his observations from the Innovation Station at CYBR.SEC.CON 2026, where emerging technologies, fresh ideas and the people driving cybersecurity innovation took center stage.
Security Debt: How Legacy Systems Increase Cyber Risk
Legacy systems create security debt through outdated controls, poor visibility and insecure dependencies. Learn how to reduce risk without replacing everything.
A Decade After Mirai: How the IoT Botnet Changed Cybersecurity Forever
Ten years after Mirai disrupted Dyn, explore how the IoT botnet changed DDoS defense, device security and internet resilience — and why it endures.
Cybersecurity Coherence Reduces Cognitive Risk, But Is Not Perfect
Three teams are talking at once. An attacker may still be active. The logs disagree. The current owner is on vacation. A cloud console shows one state, the SIEM shows another, and the incident commander has a spreadsheet that was copied from a spreadsheet that was correct last quarter.
How 9/11 Led Me to Cybersecurity — and What 25 Years Has Taught Me
Twenty-five years after the Sept. 11 attacks, I look back at how 9/11 changed my life, led me into cybersecurity and shaped how I see our responsibility to protect the systems and civilization we depend on.
Your Security Architecture May Be a Sideways Driveway
Security architecture accumulates “adaptation debt” when local fixes, exceptions and compensating controls force users, systems and now AI agents to work around designs that no longer match how identity, authority and data actually flow.
What Radio Jamming Taught Me About DDoS
From Army signal intelligence and radio jamming to modern DDoS defense, the same lessons in reconnaissance, timing, disruption and adaptation reveal how attackers overwhelm networks — and how defenders can stay ahead.