Security is a human story.

Your information is protected and I never spam, ever. You can view my privacy policy here.

Hi, I’m Chris

After twenty-five years in cybersecurity I've seen a lot, and I write about the parts that never make it onto the trust page — clear-eyed, practical and occasionally uncomfortable. Some people say I saved their career. Read on and decide for yourself.

READ MY NEWSLETTER ABOUT THE BOOK WORK WITH ME

Latest Newsletters

ALL EDITIONS

Sep 25, 2026Pre-existing ConditionsFor years, the most detailed and confident description of my security programme was the cyber insurance renewal, and I was rarely shown it.Aug 28, 2026Commercial in ConfidenceThe most used data classification label I've seen in twenty-five years doesn't appear in any classification policy.Aug 11, 2026Present Company ExceptedEvery company keeps a list of the people who are allowed to ignore the security rules. It's called the exceptions register, and it contains the same…Jul 8, 2026The Vendor Who Built Me a DoorFor most vendors, a security assessment is a chore performed for a customer they could survive losing.Jun 4, 2026No Threat Model Survives Contact with the SASFor a few years, I was an IT Security Officer for the SAS, where the people you are securing are significantly more dangerous than any threat.