After twenty-five years in cybersecurity, on both sides of the vendor table, I've come to one conclusion. Nobody knows what they're doing. Not the consultants, not the vendors, not the people on conference stages saying ‘paradigm shift’ with a straight face. Not me either. I've just stopped pretending.

I've watched things work beautifully and fail catastrophically, sometimes in the same afternoon. I've met people who changed how I think and people who made me wonder how they got through the door. I've heard stories in hotel bars that would get people fired if I wrote them down with names attached. The industry has spent decades getting very good at looking like it has everything under control while quietly hoping nobody checks.

Winging It is my fortnightly newsletter about the stuff security people recognise straight away but rarely see written down, told with less diplomacy and more jokes than the industry is used to. It won't make you better at your job, though if it turns out to be useful, I'll take it.

Newsletters by date

Looking for something specific?

Search

2026

Sep 25, 2026Pre-existing ConditionsFor years, the most detailed and confident description of my security programme was the cyber insurance renewal, and I was rarely shown it.Aug 28, 2026Commercial in ConfidenceThe most used data classification label I've seen in twenty-five years doesn't appear in any classification policy.Aug 11, 2026Present Company ExceptedEvery company keeps a list of the people who are allowed to ignore the security rules. It's called the exceptions register, and it contains the same names, in roughly the same order, as any competent attacker's target list.Jul 8, 2026The Vendor Who Built Me a DoorFor most vendors, a security assessment is a chore performed for a customer they could survive losing.Jun 4, 2026No Threat Model Survives Contact with the SASFor a few years, I was an IT Security Officer for the SAS, where the people you are securing are significantly more dangerous than any threat.May 19, 2026Mythos-Ready: Too Dangerous to ReleaseSix weeks ago, the security industry was handed the most comfortable marketing position it has been in for years. A capability nobody can demonstrate, in response to a threat nobody can measure, prepared for by techniques nobody can verify.May 3, 2026Patch 22Patching, the auditor will tell you, is a discipline. In practice, it's a hostage negotiation. Conducted monthly between the security team, the infrastructure team, and a system that hasn't been touched in fifteen years.Apr 17, 2026The Accidental CISOThe industry has spent twenty years arguing about what makes a good CISO. Certifications, frameworks, leadership competencies, threat intelligence.Apr 4, 2026A Brief Service DisruptionEvery organisation will have an incident. Someone from comms will describe it as "a brief service disruption," which is technically accurate in the same way that describing a house fire as "an unexpected change in room temperature" is technically accurate.Mar 24, 2026Every Emergency Is Best Met With a MeetingThe CISSP operates in a world where every security emergency is best met with a meeting. Where the correct answer to a data breach is never "fix the thing" or "stop the bleeding" but "assess," "determine," "evaluate."Mar 10, 2026The Subtle Art of Panicking ProfessionallyHave you ever watched an entire organisation pretend it's been audit-ready all year, only to lose its mind the week before an external audit?Mar 10, 2026The Circle of Compliance LifeHave you ever watched an entire organisation pretend it's been audit-ready all year, only to lose its mind the week before an external audit?Feb 27, 2026Please Confirm You Have Read and UnderstoodAfter twenty-five years in cybersecurity, I have come to one inescapable conclusion. Nobody knows what they’re doing. Not the consultants. Not the vendors.