I had an interesting conversation a couple of days ago, one that left me feeling unsettled. The question that was asked had to do with what I, or any CISO, might need from AI. It was at once both simple and nuanced, but I felt I lacked a good answer. Some of this is obvious - contemporary AI is proving to be a highly sophisticated engine of automation, one that can be configured through natural language prompts. Further, as a pattern-matching heuristic par excellence, AI has the potential to discover and extract extremely subtle events in traditionally noisy data. This is to say, the possibilities for AI to assist with many dimensions of security operations is clear.

AI can assist with automating data aggregation for incident response, or teasing out attack chains from disparate data sources, and as a colleague suggested, asset discovery. By routing outbound traffic to commercial AI sources through a gateway, and correlating that with endpoint data, the potential to corral AI use in your environment (or even implement DLP on AI traffic) is powerful.

This operational impact can go far beyond technical matters. Modern LLMs can be used to scan existing and new contracts for specific cybersecurity requirements, quickly building an inventory of contracts requiring attention from cybersecurity specialists. One can imagine creating an assessment tool that asks researchers, in a TurboTax fashion, a series of guided questions and spits out both recommendations for improving cybersecurity, and flags projects warranting a closer look from the security team. None of these were impossible before LLMs took off, but they have been made much easier to achieve.

But if we put this class of operational tooling to the side, what’s left? What is it that we, as CISOs - or CIOs for that matter - truly need from modern AI?

Subscribe now

What CISOs need from AI is not better tools for detecting failure, but systems that make failure - specifically, deviation from reality - structurally difficult to sustain. In short, they need governance validation as a living system. So rather than asking AI to handle SOC automation, the CISO needs to ask: can AI continuously detect when what we say, what we do, and what we fund diverge? For example, if policy says “all research systems must use MFA” (a declarative signal), while our logs show only partial adoption (a behavioral signal derived from telemetry) and our budget shows no investment in enforcement (the allocative signal), then AI is surfacing a misalignment at scale. And this happens continuously, without waiting for audits. Now we’re going beyond ordinary security telemetry by adding policy and resource allocation (budget and staff time) into the algorithm, that is, governance validation. Surely this is the space a CISO should operate within.

In my last post, I imagined a future where security becomes an emergent property of an architecture, rather than a set of layered-on controls1. This leads to a very specific framing: can AI embed security constraints directly into workflows so they are no longer negotiable? This is tricky, and probably not a short or even medium term goal. Nevertheless, if we’re to move from the chain of “CISO reviews to exception process to after the fact enforcement,” we need to start positioning AI within workflows. This would mean architecting them to handle inline decision-making (such as at procurement or research design time), and to perform real-time validation. This would turn insecure systems into “impossible states” instead of “discouraged behaviors.” As attractive as this is, it makes me uncomfortable writing it down - it begins to feel a bit hand wavey. The model is close to “get AI, a miracle occurs, security emerges.” But essentially, I’m arguing the importance of recognizing this role for AI and to begin searching for the opportunities to create and use that role in your workflows.

Share

Throughout my posts, I’ve argued for the primacy of thought work, and against its degradation by so many modern management practices. Yet there’s an important analogy to be made between the practice of cybersecurity and the analysis I provided in my discussion of Baudrillard and modern political life. In politics, hyperreality is supported by the velocity with which lies are propagated and how that far exceeds our capacity for rationally evaluating them. “Flooding the zone” is effective and as a result, people abandon truth-testing for affiliation-testing. The contemporary CISO is also saturated with signals. While they may be largely telemetry - and more akin to a map than an opinion - their complexity and interdependencies challenge not just our ability to respond to them, but to aggregate and analyze them into a higher-level description of an environment. “So you have detected 100k probes and attacks in the last hour, what does that really tell me about our security posture?”

Perhaps AI can help restore truth-testing by compressing complexity into evaluable signals. Can we leverage both the analytical skills of the modern LLM and its linguistic fluency to create synthesized, decision-ready representations of reality, to prioritize contradictions (not just risks) using some of the non-telemetric data such as resources? Can it provide explanations of why something matters in context? I admit, this does feel a little bit like cognitive offloading (which skirts a dangerous line), but perhaps if I frame this as a signals compression activity that enables CISOs’ thought work, it’s more palatable. In an absurdly complex environment, with deeply nuanced signals, AI can help restore the human capacity to evaluate reality.

I think our discussions about AI and security are focused largely on AI as a tool that helps us see more. And that’s fine, and hopefully productive. But a CISO is more than a traffic cop for security operations. The CISO needs to view not just the telemetry of operations, but all the various dimensions of cyber risk throughout their organization - that is, the organization as system. AI’s role is not to expand visibility, but to enforce alignment - binding what we say, what we do, and what we fund back to reality.

Subscribe now

I’ve had this persistent image in my mind about the implications of that favorite science fiction trope of a multi-generational starship. This is, I believe, one of the silliest solutions to the problem of space being absurdly large (and a lazy form of narrative world building). I won’t bother detailing this, many others have done so with more specificity than I have patience to do here. But the image I keep returning to is this: what happens when 3000 years into a journey, someone invents faster than light travel1 and in a short time, catches up to that ship and says “time to stop - you don’t need to do this anymore”?

The issue I want to discuss in this post isn’t science fiction, it’s about when one technology or principle leapfrogs its predecessor, rendering that predecessor utterly obsolete. In particular, I’ll explore the question: is the CISO role as we think of it today, about to become historical baggage? And if so, what should replace it and why?

Subscribe now

It seems obvious the CISO role has been undergoing an evolution. But the CISO role may be structurally misaligned with emerging architectures. The CISO has evolved from operations manager to organizational executive as the role’s scope has been remapped from technical controls to risk. What we call “technical controls” has itself been broadened from elements of technology to elements of process or workflow. Yet the CISO chafes at being constrained: limited in both span of control and recognition as an institutional operator, the CISO is burdened by an increasing scope with limited authority and span of control.

But constraint is the operative word. Especially within higher ed, the CIO has traditionally been seen as a service delivery system - focused on availability, performance, cost, or user satisfaction. In contrast the CISO is seen as a constraint system, controlling risk or enforcing control validation. These aren’t just different domains; they produce competing signals. For the CIO the success signals (and the rewards tied to them) are visible: systems work, users are happy, and delivery is fast. These are low-friction signals. The success signals for the CISO are both quieter (invisible actually) or when visible, rarely warmly embraced. The CISO signals that risk is reduced, controls are enforced, and friction is introduced (when necessary). These are cost-inducing signals. This is why organizations put the CISO under the CIO because the constraint signal is subordinate to the delivery signal.

This delta also operates in the financial space. This is why CIOs always focus on ‘optimization’ or cost reduction. Their goal is to minimize friction and accelerate delivery. Whereas the CISO generally imposes costs on the organization by introducing friction where risk demands it. Allocative friction2 would be the right label. In the context of my earlier post on deviation from the narrative becoming more expensive than the narrative deviating from reality, left to its own devices, the organization will reliably optimize for lower friction over higher assurance. After all uptime is visible while security failures are probabilistic and often delayed. In effect, the reporting line of CISO to CIO becomes a biasing mechanism w/in the institution: it structurally suppresses costly security signals.

I think this is why, every conversation about why the CISO needs to be elevated quickly devolves into some version of security needing an independent path to impose cost. We couch it in all the prose of shining a light on risk or ensuring leadership is properly informed during the decision making process, but it boils down to the same thing: pay attention, you need to resource these mitigations.

We, correctly, point out that the existing reporting structure normalizes quiet risk acceptance. We see this over and over again: project pressure leads to a “temporary exception.” A CIO incentivized to deliver will result in the exception being accepted. This disincentivizes the CISO to escalate and with that, the exception becomes the new baseline. As I mentioned in a recent post, “Behavioral signals reveal what our preferences are when under constraint - essentially signaling how we behave when tradeoffs are real.” And exceptions, especially when they become normalized, articulate our preferences more clearly than the finest policy statements.

The question is, why does this argument show up more often in discussions about the role of the CISO than in other areas? I think it’s because, sticking with the security as constraint model, this aligns it more closely with other functions that are independent from the operators they constrain. I’m thinking of roles like legal counsel or internal audit. CISOs - security - constrain the system itself. Counsel and Audit have independence from operational incentives. If we look at some of the other typically executive functions, in contrast, they optimize within the system, for example, the CFO for finance, the CHRO for the workforce, or the CIO for operational efficiency.

Essentially, the CISO can function anywhere in the organization (particularly if it benefits from multiple reporting lines), but the interrogative question we should ask is: can the organization sustain costly security signals when they conflict with delivery signals? If the entity responsible for imposing cost reports to the entity incentivized to remove it, the cost will eventually disappear.

Share

But I want to pivot a bit at this point, and introduce a new thread to the discussion. As I was talking to a friend and colleague the other day about the role of the CISO, we were marveling at the problem set being laid at the CISOs feet. Four quick examples that came up in the conversation are now plumping up the portfolio of every CISO: post-quantum cryptography (PQC), a redefinition of critical infrastructure, becoming the vanguard of cultural change, and of course artificial intelligence3. I speak to CISOs all the time both personally and professionally and almost no one has time, capacity or expertise to tackle these. These are not incremental problems, but rather they are discontinuous shifts. Most of us are flailing to stay on solid ground, while the chaos of modern information assurance spins us like cows sucked into a tornado4.

Let me briefly unpack those four examples. While it may feel like post-quantum cryptography is perpetually over the horizon, in practice we can now start to see what that looks like and anticipate its arrival. Every cryptographic algorithm currently in use, securing everything from web traffic, to personal communications, to banking, to data archiving will need replacing. Worse, we’ve just seen one of the top candidates for a PQC algorithm fall to Claude’s Mythos’ analysis. Perhaps this is a one-off, but it illustrates that the perfect storm is brewing - the basis of all secure data technologies is collapsing and the power of nearly unlimited spending is attacking its replacement.

This leads directly to the next question: the redefinition of critical infrastructure. Traditionally “critical infrastructure” was meant to cover life-safety services or health services: power, water, emergency response, healthcare. In our digitally mediated world, however, digital infrastructure now supports almost all of our daily activities. Computers steer tractors, authentication is required to access medical care, most financial transactions are digital. For higher education, as we saw with the recent Canvas incident, when digital systems disappear, so does instruction and much of research. Eliding with PQC, if the algorithms underpinning digital activity collapse, should every cryptographic element now become part of your inventory of critical infrastructure?

Finally, what do I mean by cultural change? For the CISO (or really, any security professional), cultural change results from our introduction of friction into existing practices. Wanna get on the network? Now you’ve got to register your laptop. Wanna access a specific website? You’re going to need MFA installed on your phone or a token. But today, the real action is in the research space. Addressing security mitigations is far more than just requiring faculty to use MFA or back up their data: it’s introducing constraints into a system that has long operated without or with minimal administrative influence. It’s a separate system entirely, one that prides itself on autonomy, discovery, and entrepreneurialism. CISOs need to approach research less as established functionaries in an organization, but more as anthropologists studying a foreign civilization5.

Share

If the portfolio has expanded to include quantum-proofing civilization, redefining critical infrastructure, and rewriting faculty culture - all while trapped inside a reporting structure designed to subordinate constraint to delivery - the current CISO role hasn't just become difficult, but pyrrhic. Add to this the sizable personal liability CISOs now face by having, for example, to attest to security practices for any number of data sharing agreements or to the accuracy of SPRS scores6. Modern CISOs are increasingly treating employment negotiations like corporate officers and demanding specific D&O (Directors & Officers) insurance coverage, explicit corporate indemnification, and dedicated budget for independent legal counsel before taking a job. Given how far higher education has to go in this dimension, one begins to question the viability of the role in its entirety. Or at least the wisdom of anyone incautious enough to accept it.

Which returns me to the example of the poor, obsolete generational starship. Despite FTL travel, the starship doesn’t have to abandon its mission. It’s free to continue on its course, struggling with the inertia of endless existential maintenance and social stress. But it is no longer relevant in the larger saga of human expansion into space.

The modern CISO role is our starship: a self-contained artifact of historical practice driven by inertia, while discontinuous shifts in technology and liability warp space around it. Are we so mired in existential and social maintenance, that we are blind to being made obsolescent by the advancement of the world around us? The present crisis is not a temporary gap to bridge, but a reckoning - the role is being left behind by the very world it was built to secure.

Obviously, I’m suggesting the CISO is a transitional role - necessary for a prior architecture of control, but misaligned with the one we are entering. The question is not whether the role continues, it clearly will, but whether it remains aligned with the architecture of the world it is meant to secure.

To practice cybersecurity today feels like we are trying to enforce a traditional “architecture of control” over an increasingly chaotic and expansive domain: it’s like trying to manage air traffic with a stop sign. The CISO is left maintaining the rituals of control (e.g., policy documents, annual awareness training, and manual audits) while the actual velocity of technology and data moves around them unimpeded.

I see the necessity of moving past the current formulation of the CISO as a consequence, not of role failure, but of the CISO having to bridge two incompatible paradigms. In the first, we have security as a managerial function. Here security is treated as a separate function that “adds protection” to existing systems, after the fact, through policy and monitoring. That is, security as an overlay. In the second, we have security as an ambient attribute. Security is built into the underlying “physics” of the architecture itself. A place where data provenance, cryptographic boundaries, automated compliance validation, and resilient systems are native to how code, networks, and data operate. This is security as a system property. These are not incremental problems—they are discontinuous shifts. Thus the modern CISO must simultaneously engineer systems while effecting cultural change, all while swallowing institutional liability.

In an earlier post I argued for the evolution of the CISO into something called a Chief Digital Risk Officer (CDRO)7, largely decoupled from operational responsibilities. I still believe this is the right next step for institutions. It represents a kind of codification in different people and roles, both of the two paradigms I just described. But does it truly position us for the kind of disruptive changes we can already anticipate for our environment?

It’s a valuable exercise to speculate on the future of the CISO. If we stick with evolutionary models, the CDRO is not a disruptive step, it’s a kind of adaptive mutation, not a speciation event; fundamentally it is a specialized form of CISO. However, increasingly the field is leaning into risk enforcement as embedded and federated: where security decision rights are codified into platforms, pipelines, and procurement gates. In many ways we’re trying to change security from a centralized constraint function to become a property of the system’s governance fabric. I don’t need to review every software purchase, the purchasing process natively enforces this for me8.

If we want to continue evolving the CISO, we want to ask what it would take to achieve an environment where we’re not managing exceptions but designing systems where exceptions are impossible or irrelevant. This suggests not a CISO but something like a Chief Trust Architect, who is not managing risk, but rather they’re eliminating entire classes of risk through design constraints.

Of course, once this sort of role is possible, the next logical step would be to imagine it within the context of automation, AI driven or not. Here we’re moving from human decision making to machine-enforced reality. Essentially a policy compiler coupled to control plane ownership. In this world a non-compliant system doesn’t trigger a meeting, but is entirely unable to deploy. Similarly, unauthorized data use isn’t ‘detected’, but cannot be executed. This is truly the disruptive moment (and frightening in some ways given how technology can be abused by authority), but with this realized, the CISO as we know it, disappears. Security is no longer a function, but an emergent property of the architecture. Risk management has been transformed into risk elimination9.

Even today, we see elements of this vision manifesting in our environments. But these remain narrowly scoped and are exclusive to technology. We don’t see it in the human and governance dimension. Of course, this is precisely the dimension most CISOs struggle with. While technology can be compiled, human trust and faculty governance cannot. If we automate the technical controls, the actual work left for security leadership isn’t managing firewalls, it’s navigating human politics, institutional ethics, and research trust. This is particularly challenging in higher education, because university culture is explicitly built against centralized control planes and “policy compilers.”

Earlier I described the breakdown of signals, when the organization cannot sustain costly behavioral or allocative signals, it defaults to weak ones such as policy or exceptions to those policies. The system’s true preference is for delivery over assurance. In the vision I’ve described, you can see a new signal architecture defined: that of “ambient security,” where in place of declarative signals (e.g., “policy requires MFA”) we are moving towards compiled behavioral signals, (e.g., “non-MFA systems cannot deploy”). This doesn’t just evolve the CISO but it eliminates the gap between signal and enforcement. That’s a transition from social signaling systems to computational signaling systems.

In the final analysis, all of this suggests that while the technology will become ambient and self-enforcing, the CISO role will either dissolve into platform code or survive strictly as a political/diplomatic function that mediates between human culture and machine enforcement. The CISO exists today as the human mechanism for enforcing costly signals, but as institutions fail to sustain those costs, the role may be displaced by architectures that make deviation impossible rather than punishable.

Subscribe now

Let’s begin by describing what Baudrillard meant by “hyperreality”: hyperreality is a condition in which media, signs, and symbols become so pervasive that they replace objective physical reality, leaving behind a world composed entirely of self-referential simulations. In this state, the boundary between the real and the representation collapses, and the copy - or simulacrum, in his terms - becomes more authentic, engaging, and real to people than the actual world it originally represented.

Subscribe now

This should be all too familiar to any of us, raised in a world where vitamin-enhanced sugar cubes are marketed as “part of a balanced breakfast” and water is mysteriously labeled as “smart”. Ultimately, hyperreality is a system where symbols and ideas no longer refer to underlying truths, but only to other images, substituting genuine experience with a manufactured consensus. In our own hyperreality, patriotism is reduced to a performance of symbols - allowing us to ignore the material mistreatment of Gold Star families and veterans.

Baudrillard warned that late-stage media environments produce “more and more information, and less and less meaning.” In the vocabulary of institutional signaling, this is far more than information overload: it is signal collapse. What do I mean by “signal collapse?” The key is to remember that “signal strength is defined by the cost of deviation from that signal. That is, a signal is strong to the extent that it is costly for the institution to violate it. The strength of a signal isn’t about how loudly it’s stated - it’s about how painful it would be to act against it.” This is, to my earlier question, the key to understanding how we arrived here.

Earlier I noted that declarative signals (writing a policy, issuing a statement, making a public claim) are cheap signals because they carry almost zero cost of deviation. In contrast, allocative signals (reallocating budgets, shifting capital) and behavioral signals (actions taken under constraint) are expensive signals because they require tangible sacrifice. If there is a cost to diverging from a signal, the signal becomes more valuable.

But when our media ecosystems overproduce declarative signals at a velocity that exceeds our ability to evaluate those signals, the traditional mechanism of truth-testing breaks down. We (the public) adapt by substituting truth-testing with affiliation-testing. Thus, truth-testing is expensive; it requires evaluating claims against empirical evidence, institutional baselines, and allocative reality. Further it may be practically impossible in the political realm. How is anyone to tell if “those votes were rigged”?1 While affiliation-testing is cheap: evaluating a claim based solely on whether adopting it signals alignment with an identity group. “I’m with the guy who looks, prays, or hates like me”. Being cheaper and faster make affiliation-testing very difficult to challenge.

Once hyperreality is birthed, especially in our modern media ecosystem, it becomes a self-supporting feedback loop. It persists because modern media platforms are structurally engineered to maximize engagement, and engagement favors friction-free claims. A declarative signal - a tweet, a viral soundbite, an outrage-inducing headline - costs nothing to produce, spreads instantaneously, and demands zero cognitive effort from the consumer. It offers immediate identity reinforcement. Hyperreality persists because platform incentives and identity reinforcement reward the consumption of cheap declarative signals over the friction of real-world allocative facts. When algorithms optimize for attention, cheap declarative signals win every time, driving out the heavy, inconvenient weight of empirical reality.

It’s worth examining Baudrillard’s four stages from reality to hyperreality. We begin with stage one, where the symbol is a faithful reflection of reality. The classical example of stage one is a map that accurately depicts the terrain - or perhaps a true empirical accounting of a research budget. Stage two (usually labeled something like ‘masking and perverting reality’) takes us to the familiar space of traditional political spin. In stage two, the facts are manipulated while still acknowledging that an underlying factual reality exists.

Stage three (dedicated to masking the absence of reality) is where we really see the dominant mode of modern hyper-politics. The “Stop the Steal” movement constructed a dense ecosystem of affidavits, hearings, and legal filings designed to mask the complete absence of a stolen election. Similarly, the Border Wall functioned primarily as a Stage 3 symbol - a massive declarative signifier of “absolute security” masking the complex, un-wallable reality of visa overstays and global supply chains.

But even stage three is an incomplete description of what we see unfolding around us. In stage four, what Baudrillard would call pure simulacrum, we emerge into a new meta-level of media. Here, interpretive signals - how leadership frames reality - become entirely decoupled from allocative reality (what is actually funded or operationalized). “We’re winning bigtime” while losing. “We have far more munitions … and far more than we need,” while pausing attacks due to munitions shortfalls. In this stage we see executive leadership reacting to cable news chyrons about tweets regarding previous cable news chyrons2.

This brings us back to the notion of signal strength. Historically, democratic institutions enforced norm stability because the cost of deviating from objective reality was relatively high. If a political leader made an empirically false claim, a kind of institutional friction developed: friction created by the press, the judiciary, and oversight bodies, which imposed a non-negotiable penalty. With this in mind, it should be of no surprise that these three agents are precisely those targeted by the current administration. I suppose I should add academia to that list - science strives to concern itself with expounding ground truths, and academia distills those, becoming both a voice for them and a conduit for inculcating them into the civic body. Essentially, academia represents another source of friction - it introduces a cost and a challenge to the meta-level creation of false narratives that make up Baudrillard’s stage four3.

In a nutshell, I see our modern world as the result of an inversion of the traditional cost structure where deviation from reality is expensive. Hyperreality describes a system in which institutional decay renders those costs weak, non-binding, or selectively applied. The penalty for deviating from empirical reality no longer propagates reliably through the ecosystem. In a healthy institutional system, an empirically false claim acts like a fault in a circuit: it triggers corrective friction across independent nodes such as courtrooms or newsrooms. In a hyperreal system, that circuit is broken. The false signal is absorbed, amplified, or insulated by partisan echo chambers, allowing the speaker to suffer zero penalty from their base while actively gaining power from the outrage it generates. We see this daily - the louder we yell, the more we amplify and reinforce the false signal.

Share

When the cost of deviating from reality drops, the incentive structure inverts: the primary cost becomes deviation from the narrative. To acknowledge empirical reality when it contradicts the identity-binding simulation (e.g., a local official certifying a clean election or a public health officer acknowledging epidemiological data) is to risk immediate, total exile from the ecosystem that confers legitimacy and power. The cost of standing with reality becomes infinitely higher than the cost of embracing the simulation. I suspect Anthony Fauci could testify to this inversion of cost.

We see this played out in at least two dimensions. Speaking truth that conflicts with hyperreality brings the immediate flood of condemnation and smears from the administration and right-wing echo chamber (top down); simultaneously, we see the explosion of trolls (the bottom up) whose vehemence seems mysterious unless understood in terms of the identity affiliation test. Trolls are not (merely) attacking the contrary voice, they are identity signalling to their own compatriots. Like termites, the material they chew becomes the scaffolding of the hyperreality they have embraced4.

At this point, I’d like to revisit my earlier observation that institutions don’t reveal their strategy through aspirational documents; they reveal them through what they tolerate and what they fund. I think this is significant for I don’t view Baudrillard as an epistemological lament about the lack of meaning. Rather, I’m interpreting it here as a theory of power. Our public institutions, the courts, scientific bodies, research universities, election boards, they exist precisely to act as reality anchors. They exist to enforce the cost of deviation on false signals.

What we have seen exposed through the current era, is the profound fragility of these institutions. Decades of press consolidation, partisan gerrymandering, and the erosion of shared authorities had already weakened these anchors5. This shines a light on why, during the Reagan era, the Federal government was so targeted as “the problem.” This marks, perhaps not the start, but the point of acceleration for the attack on those elements of friction that hobbled the establishment of modern hyperreality6. When institutions fail to enforce the cost of deviating from reality, the simulation expands to fill the void.

In this environment, narrative control is not merely public relations; it is operational authority: when institutional signals decay, power is reallocated to whoever controls the simulacrum. This is, I think, the core of why so many of us are so frustrated. We hear the propaganda, we find the lies transparent, yet our sense of that friction affects no change. What appears to us as a detachment from reality is, more precisely, the fragmentation of institutional authority over what counts as real. We are living in two worlds - the real and the hyperreal simultaneously.

Share

Naturally, the big question is how we re-establish a cost for deviation from reality. The sheer speed with which the mechanisms of hyperreality operate make this extremely difficult. Imagine the challenge of responding to 168 posts in a single day on truth social. Of course, simply the act of reporting on them is an amplification of them. How are we to introduce a cost to this flood of dreck?

The obvious option is to move from asserted capability to measured outcomes. Which neatly mirrors my claims for cybersecurity. Just as we move from vendor tool claims to raw telemetry and control validation, in politics we must move from narrative assertions to empirical reality and institutional verification. This is to say that we shouldn’t ask politicians to “be more honest” (a cheap declarative appeal); the solution is to re-architect institutional governance so that political claims are automatically subjected to “control validation” (such as statutory review triggers, real-time spend tracking, and binding metrics).

Hyperreality is what happens when asserted signals replace measured signals as the basis for decision-making. Thus we must restore costly institutional signals. In the context of cybersecurity and governance norms, I identified three primary steps: first, we need publicly binding metrics. It is necessary to move from vague claims of integrity to transparent, un-gameable metrics that create real operational consequences when violated. Next, we require shared behavioral commitments. For cybersecurity, this means cross-institutional mutual aid, pre-negotiated baselines, and joint accountability mechanisms that make narrative deviation painful. Finally, and perhaps most difficult, we should require allocative alignment. This means refusing to accept strategy documents or political rhetoric that are not backed by hard budget reallocations and structural enforcement.

Can analogies to these be found for politics? Fortunately, we can use the current administration as a guidebook to identify what’s missing from our current governance structure. It is a literal roadmap for where institutional signals fail to impose cost. For publicly binding metrics, they will matter only insofar as they create enforceable consequences - automatic review triggers, statutory penalties, or loss of authority when thresholds are violated7. We want independent, real time budget transparency, not just appropriations, but actual spend tracking tied to stated policy goals. And of course, election system metrics, such as audit rates or certification timelines.

For shared behavioral commitments we want cross-institutional constraints that bind behavior even under pressure. These might include pre-committed election integrity pacts, where all parties agree in advance to honor certified outcomes and legal processes. Surely we can legislate cross-branch enforcement norms, e.g., automatic compliance with subpoenas and bipartisan oversight triggers where predefined conditions force joint investigation regardless of party control.

If in cybersecurity, budgets and not policies reveal truth, then in politics allocation is the only credible signal of priority. But remember, it’s not just spending that matters, it’s spending on actual threats. Allocative alignment is not “money is spent.” It is “money is constrained by measurable reality and produces falsifiable outcomes.”

In my cybersecurity framing, allocative signals are strong because they are costly to reverse, they are observable, and critically, they are anchored to operational reality (i.e., risk, incidents, systems). But in politics, many allocations fail that last condition.

For example, immigration enforcement spending clearly signals a commitment to a narrative, but is not actually in alignment with empirical threat models - it lacks clear success criteria that could invalidate the policy. Thus it is a costly signal, but one that is not constrained by any truth8. Essentially we have a budget tied to symbolic priorities, where success is defined internally to the narrative and we lack any mechanism for disconfirmation. Ironically, the problem is not that we fail to spend; it’s that we increasingly spend in ways that reinforce narratives rather than constrain them.

Thus, what we are observing is not merely narrative distortion, but a systemic control failure: institutions no longer enforce the constraints that bind signals to reality. If we’re to restore reality, then claims, behavior, and resources must be forced back into alignment.

As in cybersecurity, the true test of a system is not its steady-state signaling, but its behavior under stress. Elections, pandemics, and international or economic crises exposed that institutional signals no longer held under pressure.

Norms are not sustained by agreement; they are sustained by coordinated, costly signals that produce real-world consequences. Trump was not the architect of a post-truth world; his administration was the first political entity to fully optimize for an environment where American institutional signaling had already collapsed. Until institutions are willing to make deviating from real-world reality costly again, the simulation will continue to govern.

Subscribe now

Throughout a handful of posts, I’ve been exploring the idea of cybersecurity norms - wrestling with just what norms are, and what it means to have norms in the first place. In the most recent piece, where I posit a modest list of norms, I argue that despite the daunting challenge of establishing norms across an entire sector or nation, we have more agency than it may appear. Essentially, the starting point in establishing norms is to simply start talking about them; talking leads to changes in practice, messaging, and ultimately informal agreements and beliefs. Ideally these form a precondition for the codification of norms in law, treaties, and similar durable frameworks.

Subscribe now

I came to this belief not through a linear path from an analysis of norms to a pattern of practice, but organically. As I’ve described elsewhere, it gets exhausting listening to people complain about organizational culture, all while normalizing the very culture they’re complaining about. Similarly, I’ve written critically about strategy documents, having said that, if you want to truly understand an organization’s “strategy,” examine its budget. Institutions don’t reveal their priorities through strategy documents - they reveal them through signals: what they codify, what they fund, what they tolerate, and what they ask.

Most recently I started thinking about how an organization “signals” anything, and specifically, norms. That is, what I want to call institutional signals are the externally and internally visible manifestations of how an organization operationalizes norms - revealed through decisions, structures, language, and behavior under constraint.

It’s important to realize that all signals are not equal. Some are cheap, some are costly. The costly ones are more trustworthy. For example, writing a policy strikes me as a cheap signal. Publishing a report is a tad costly, a medium signal. Reallocating budget, on the other hand, is an expensive signal. Meanwhile, revoking a policy exception or changing behavior is a very expensive signal.

Which leads me to propose that signal strength is defined by the cost of deviation from that signal. That is, a signal is strong to the extent that it is costly for the institution to violate it. The strength of a signal isn’t about how loudly it’s stated - it’s about how painful it would be to act against it.

I want to use this post to explore institutional signals—because if we, as a community, are going to find our voice and establish durable norms, we need a consistent and recognizable set of signals for how we engage with each other and with society.

We should start by looking at what it is we actually say. I’m thinking of explicit statements of intent and identity. Statements that signal “here is what we claim to value.” Three distinct examples come to mind. Obviously, a signal could be the codification of norms and policies. Fairly weak, but still a signal. Another example might be a transparency report. I’ll expand on these in a later post, but I think they represent yet another relatively simple, but impactful, opportunity for collective action and norm establishment. Finally, you’ll see statements about regulatory alignment that sound great, but are truly more performative than not. Statements about HIPAA compliance within the health sector, or privacy compliance in the commercial sector. Especially within the U.S., most cybersecurity and privacy regulations are floors - bare minimums that are able to be enacted despite our pay to play legislative system. Treating the floor as a statement of high institutional value is the very definition of a cheap signal.

We should next consider what we actually value. Perhaps “allocative” is the proper adjective here. What we fund and prioritize - allocative signals - would include budgetary proportionality. As we’ve all noticed, our organizations invest the vast majority of cybersecurity funding into enterprise systems; while largely neglecting the truly existential research mission. While we are beginning to see cybersecurity inserted into research proposals (at least sufficiently to cover mandated security controls), this is still rarely done institutionally and at most schools it is rather ad hoc. Nevertheless, it feels like an issue of proportionality, an allocation of effort, so I’ll leave it as an example here.

I can think of two additional classes of signals: what we do under pressure and signals that reveal how we think and frame reality. I’ll label these behavioral for the former, and interpretive for the latter.

Behavioral signals reveal what our preferences are when under constraint - essentially signaling how we behave when tradeoffs are real. For example, when we make an exception to a policy or a norm we are exercising exception discipline. While exceptions are deeply ingrained in cybersecurity (through the notions of a compensating control and risk acceptance) they do surface how an organization balances competing demands, perhaps more clearly than any other signal.

Similarly, how an organization chooses to participate in sector activities is another form of behavioral signal. Any reader of this blog knows that I feel this is an area we - the higher education sector - are not giving enough attention to. Though that in itself is a deafening signal. I’ll say more about this in a moment.

The final class of signals, interpretive signals, demonstrate how we (usually management and leadership) understand a problem space1. As I’ve discussed in earlier posts, the intellectual style of executive inquiry and the use of reductionist language are massively important - and loud - signals to our organizations.

Share

I want to pivot somewhat from a theoretical discussion of signals, towards concrete steps we, as individuals and organizations, can take. Can we inventory a set of organizational signals that could be used to advance the establishment of cybersecurity norms, and thus, the practice of cybersecurity writ large? The purpose of my classification of signals is to provide a framework for just such an analysis - to bring a little discipline to the subject.

We have already examined three examples of declarative signals:

• Establishing a policy

• Releasing a report (the result of an analysis)

• Performative regulatory compliance.

And we’ve all seen how these signals get amplified - for example, when one institution models a policy on another’s. Unfortunately, that amplification is rarely one of directed or community action. It happens by passive diffusion, i.e., informal adoption of a policy in broad strokes, rarely even with public acknowledgement2. But without that signal of acknowledgement - of declared shared belief - what does it really accomplish? Recall that my goal is to encourage the establishment of norms, which raises the bar considerably. It’s no longer enough to say “everyone has a policy on AI,” but rather, “can’t we develop a sector-wide AI policy for general adoption?” Or perhaps, given pressure to fold research activities into a research security program, could we develop a framework for such a program under the auspices of an organization such as AAU or APLU that is broadly used to shape local programs?

The value of this approach is not just in the establishment of a norm, but to demonstrate to external regulators, federal sponsors, and society at large that we have the maturity to act cohesively. Essentially I’m hoping we can move beyond observation (“here’s what we see among our members”) to sector agency (“we came together and agreed on a norm.”)

While declaring and speaking is powerful, acting has much more impact. Here we move to consider examples of allocative signals. Obviously, expecting institutions to reallocate massive capital overnight toward research cybersecurity - where the vulnerability is most acute - is unrealistic. But we can create the conditions that apply pressure for re-allocation of resources and signal those. I can imagine goals being set and metrics collected on one or two dimensions of cybersecurity related to resources. Perhaps something along the lines of “percentage of operating budget devoted to research cybersecurity.” Or, “percentage of grant proposals that include funding requests for cybersecurity elements.”

I’m not going to hazard a guess as to what those percentages should be - but a public commitment to achieve some community agreed upon percentages would be a tremendous forcing function. To anyone who’s rolling their eyes: remember, it’s the absence of metrics and commitments like these that gave birth to programs like CMMC and NSPM-33’s cybersecurity requirements. We are quietly reaping what we’ve sown3.

It’s reasonable to be skeptical that establishing these goals and publishing progress metrics will result in any actual reallocation of resources. Yet, organizations are competitive; donors, agencies, and legislators will see those metrics and ask about them. What’s important in this scenario is not just the selection of a goal for each metric, (though the work to develop these is valuable); that is merely a declarative signal. What pushes this into the allocative class is the publishing of performance metrics and the pressure that results from that visible signal4. After all, if we want norms, we need shared signals. If we want shared signals, we need shared metrics. And metrics only matter when they create consequences.

It’s hard to imagine a point in time when behavior under constraint is more relevant. We’re seeing school after school wrestle with the contraction of Federal funding, the open assault on academic freedom, and aggressive censorship - the complete politicization of the academic sphere. Any discussion of institutional signaling would be incomplete without pointing out that there is a deep fear of signaling due to the current administration’s actions. Signaling can put a target on your back. This is to say, that while there is a cost to signaling, there’s also the cost of signaling under political pressure. In fact, it is the highest-cost signal: signaling when the penalty is external, not internal.

Be that as it may, I can think of a few behavioral signals worth adding to our inventory. I mentioned exception handling; basically the curation of exceptions to policies and standards. While the nature of research activities will necessitate exceptions (either through compensating controls or risk acceptance), institutions will need to adopt via policy a stance that 1. exceptions must be treated as first-class objects with lifecycle management, not informal accommodations, and 2. regulatory and policy interpretation must be owned by a single authoritative function, not negotiated ad hoc.

But those are local matters - for the purposes of this post, I’m more interested in how behavioral signals are created. Are we prepared to take action as a sector on questions of cybersecurity? Some of these should be fairly straightforward to build consensus around, for example, the deployment of staff or expertise to assist peer institutions during active incidents, or a willingness to loan tooling, licenses, or infrastructure capacity during crises5. This could include a commitment to participate in cross-institution incident response exercises. But all of these rest on the presumption of pre-established mutual aid agreements for cybersecurity response.

Imagine the impact of a consortium agreement, especially in light of our current budget crisis, that pledged the protection of baseline cybersecurity funding during institutional budget cuts.

Share

Some behavioral signals seem obvious to pursue. Such as participation in joint development of frameworks (not just their adoption), or a willingness to publicly endorse and align with sector-wide baselines. Are schools prepared to contribute to open security models, playbooks, or reference architectures? Though I’m not sure how we capture whether institutions deviate silently or openly challenge and refine shared norms.

Others start to truly bring the pain: those that bring transparency under reputational risk. For example, publishing post-incident reports with meaningful technical detail. I used to have more sympathy for holding this information close to the vest, but I now believe that in our modern threat landscape, this habit works against us. The bad actors already have these details - that’s why they were successful. Hiding this information only damages our community. We must develop the willingness to expose internal gaps or failures publicly.

Behavioral signals are where norms stop being aspirational and become visible. This is because they reveal what institutions are willing to do when cooperation is costly and reputation is at risk, particularly under time constraints. This is why they’re worth more attention - they are quite literally the establishment of norms in action.

I’m going to skip over interpretive signals for the most part, I’ve written at length about them before. But before moving on, let me bullet point the various signals I’ve described into a list with some expanded suggestions.

Declarative Signals (explicit statements of intent and value)

• Codifying broad policies: publishing institutional policies on emerging domains, such as AI usage or research cybersecurity governance.

• Releasing analytical reports: publishing transparent institutional reports on the adoption and efficacy of security controls within research programs.

• Establishing performative regulatory baselines: agreeing upon a sector-wide baseline interpretation for implementing federal standards, such as NSPM-33 controls.

Allocative Signals (resource commitments and visible metrics)

• Tracking budget and proposal metrics: formally committing to target benchmarks - such as the percentage of operating budget dedicated to research cybersecurity and the percentage of grant proposals requesting explicit security funding - and publicly publishing progress metrics for both.

Behavioral Signals - Local Discipline (internal governance under constraint)

• Standardizing exception management: creating a sector-wide, shared repository of compensating controls and formal risk acceptances tailored specifically to research environments.

• Centralizing regulatory authority: codifying in policy that all regulatory and compliance interpretations regarding research security are owned by a single internal authoritative function, rather than negotiated ad-hoc across departments.

Behavioral Signals - Sector Collaboration (costly, active cooperation under fire)

• Codifying mutual aid agreements: establishing formal, pre-negotiated cybersecurity mutual aid agreements across systems and regional consortiums.

• Operationalizing emergency staffing: creating clear policy and execution mechanisms to rapidly deploy staff and technical expertise to assist peer institutions during active incidents.

• Pre-clearing emergency resource loans: standardizing contract language that enables - and explicitly signals a willingness to execute - the loaning of tooling, software licenses, or infrastructure capacity during crises6.

• Executing joint exercises: establishing annual, cross-institutional incident response exercises with mandatory participation commitments.

• Committing to transparent post-incident reporting: publishing detailed post-incident technical reports as early as technically feasible - potentially allowing a trusted peer partner to draft the report during the incident to expedite its public release.

Not surprisingly, in practice many of the signals from one category are coupled synergistically with others. Behaving one way is something; telling people you’re doing it is another. Coupling the two not only carries operational weight but is almost the definition of creating accountability.

Norms are not created by agreement, rather they are created by coordinated, costly signals that produce consequences. The list above makes no claim to being comprehensive. It’s not difficult to expand upon it. But I offer it up as a model to build upon, a model of institutional behavior change.

Subscribe now

Perhaps the obvious starting place is to ask if the use of cyber weapons is even in our writ. Earlier I drew parallels between the use of bioweapons - a category of munition that has both norms and binding regulations governing their use - to cybersecurity. Are malware packages and hacking tools a form of munition and if so, are the norms covering their use part of the field of cybersecurity1?

If you start researching cybersecurity norms first thing in the morning, you’ll find yourself with plenty of time for a lengthy lunch. A review of the current international consensus reveals fewer than a handful of foundational agreements, though one, the Budapest Convention, is essentially superseded by the UN Convention against Cybercrime (UNCAC), so perhaps three. Of the remaining two, none have any binding obligations. It’s noteworthy, though not entirely surprising, that the US is not a signatory to the UNCAC.

I want to talk about norms in the cybersecurity context, but let me begin by defining the ecosystem we’re talking about. To use a now less common term, cyberspace, which is a layered, interdependent system in which digital actions propagate across technical, physical, and institutional domains, and where certain classes of systems - those sustaining human life, shared infrastructure, and societal legitimacy - possess a higher moral and functional status requiring both restraint and active stewardship by state actors. It is a system with keystone species (DNS, hospitals), shared habitats (supply chains), and cascading failures; failures that propagate across human, technical, and institutional planes.

Subscribe now

But I feel it’s necessary to work our way to norms from more general primitives. So let’s talk about the four ontological classes that come to mind:

• Human life systems (a biophysical layer)

• Shared systemic infrastructure (a digital commons layer)

• Institutional systems (the socio-political layer)

• Actors (a layer of agency)

In the biophysical layer, digital disruption leads to immediate physical harm. In this class we have the obvious, such as hospitals and other medical facilities, industrial control systems (such as water, power, and nuclear), and the not so obvious, such as emergency response systems.

The commons layer is where any “corruption” leads to systemic loss of trust or function across many actors. I would place items like DNS or supply chains in this class - perhaps even software ecosystems. Systems where the fragility is manifest through interdependence.

For the socio-political layer, we see any sort of manipulation can lead to a loss of legitimacy or social order. The most timely example of this is the attempted election interference from Russia in support of Trump. But equally as valid is the onslaught facing academic research and science - both from the administration and from malign foreign actors and insiders.

Finally, with the agency layer, we have both state and non-state actors; but in either case I personally view the state as the primary unit of accountability - even in a transnational digital system.

Layered over these we can create a simple tiered ontology of harm. From 1. immediate physical harm (death and injury), 2. systemic functional collapse (internet instability), to 3. institutional/epistemic harm (corruption of knowledge or loss of trust).

At this point I think we’re ready to start talking about norms, but I want to offer up one more ontology on the way, an ontology of norms. I think this is the easiest to define: we have obligational and prohibitive norms. Prohibitive norms are those where an actor must show restraint, e.g., don’t attack hospitals or don’t poison supply chains. This is analogous to the prohibition on attacking ambulances in war zones. An obligational norm is one where you must act. Inaction itself is a form of harm. Examples of this would be safe-haven accountability or mutual assistance. Critically, responsibility extends beyond direct action.

Essentially I’m arguing that it’s sufficient for our purposes to say the world consists of: life-critical systems (which must never fail), shared infrastructure (which must remain trustworthy), institutions (which must remain legitimate) and actors (must exercise restraint and responsibility). For our purposes, harm flows upward from technical disruption to human and societal consequences.

Ontologies tell us things about reality - that is, what exists and what fundamentally matters. If we’re going to move toward defining norms of behavior, then we need to place everything into a taxonomy. The taxonomy is how I’m going to arrange the elements of the ontology. The taxonomy is what we say out loud: a structured list of norms. The ontology is the quieter claim underneath it: a theory of what kinds of systems exist, which ones matter more than others, and how harm actually propagates between them. If the ontology is wrong or incoherent, the taxonomy will feel arbitrary. If the ontology is sound, the taxonomy becomes almost inevitable. I think of it as the index of rules built on the ontological models. This is necessary if we’re to move beyond abstractions and to discrete action statements2.

Share

So anchoring my taxonomy of cybersecurity norms are human safety and life-critical systems. These are non-negotiable prohibition norms. They represent an absolute floor, for which violations create a direct risk to human life. Expanding slightly on the examples I gave above, we have three fundamental norms:

• Medical sanctuary
  No targeting of healthcare systems, public health infrastructure, or medical supply chains.

• Life-critical infrastructure protection
  No operations against ICS (power, water, nuclear, etc.) where failure cascades into physical harm.

• Emergency response immunity
  No disruption of CERTs/CSIRTs or disaster-response networks.

(You’re probably already scoffing since we know hospitals and ICS systems are regularly targeted today. Remember, we’re building norms at this point, not looking at what’s actually happening. It’s what’s happening that’s a forcing function for the creation of these norms.)

Next in our taxonomy we have the integrity of shared systems. What might be called the digital commons. These preserve the baseline trust required for a functioning global digital ecosystem.

• Core internet infrastructure protection
  No tampering with DNS, NTP, BGP, routing, or physical backbone systems.

• Supply chain integrity
  No deliberate insertion of vulnerabilities into widely used software, hardware, or open-source ecosystems.

• Responsible vulnerability handling
  Maintain disciplined vulnerability disclosure practices (VEP-style), with narrow and time-bound exceptions.

Third in the taxonomy is something we might call institutional integrity and civil order. These are norms that if realized would protect societal and governance functions from destabilization.

• Electoral non-interference
  No manipulation of election infrastructure or outcomes.

• Civic and knowledge system protection
  No disruption or destruction of academic research, scientific collaboration, or public knowledge systems.

Finally, drawing from my comment on state obligations in the agency layer above, we have state responsibility and active obligations that apply across all domains - they’re not a separate category but a behavioral overlay.

• Safe-haven accountability aka due diligence
  States must not allow their territory to be used for persistent cyber harm.

• Mutual assistance norm
  States should assist in the defense and recovery of critical civilian systems under attack.

It’s natural to look at these and ask how they’re articulated by your organization, which is probably not a “state” (nation state or otherwise). I suspect that while it may appear the most aspirational, this last category may prove to be the most relevant for commercial and academic organizations.

This taxonomy adapts the traditional principles of kinetic non-combatant immunity to the realities of a digital ecosystem, though I’ve tried to expand on that a bit to address our modern digital ecosystem. At least, I believe it provides a reasonable framework for further expansion. I suspect a fuller analysis would look at each proposed norm (and others, it’s by no means comprehensive) and weigh it against impact and resilience for the purposes of finely tailoring each norm. I’ve drawn them with a fairly broad brush here.

But we should consider the issue I dismissed as an aside above, that is, what do we see in practice today and how does the ground reality of modern cyber attacks influence our thinking about norms?

I’m not going to detail just how bad it is right now - I’m really struggling to identify any cybersecurity norms in effect. Half the email I get from Federal authorities is concerned with attacks on infrastructure - that of water and power. The other half are the steady drumbeat of health systems having data stolen or patient systems disrupted. In a world where a superpower states, “A whole civilization will die tonight, never to be brought back again; I don't want that to happen but it probably will,” how are we to argue for restraint from criminal organizations? Norms matter, even when they’re being ignored.

Share

Naturally the frustration you’re probably experiencing stems from what seems like an insurmountable problem: it feels like there’s little or nothing any of us, or even our organizations, can do to establish international norms, norms that appear to be ignored, violated, or deliberately undermined daily. While it’s true that a norm remains voluntary until it’s codified in law, I think it’s important to remember that by definition a norm is “a shared expectation about appropriate behavior within a community, sustained not primarily through formal enforcement, but through mutual recognition, reputation, and the prospect of inclusion or exclusion3”.

Thinking about how we choose to express that shared expectation allows me one last ontology, one not of agency, but of expression. This differs from the agency layer I described above, for I’m not talking about the “agency to behave according to norms” but rather, “how norms are instantiated at different levels of social organization”. One deals with the capacity to act, while the other is how norms are operationalized.

This is the moment, in a piece that might be seen as somewhat discouraging, of surprising optimism. For despite our apparent individual insignificance in the grander scope of society, norms begin with the aggregation of behavior and belief, which we express through actions and words. Our agency may feel miniscule, but generally speaking, this is how things actually work. One voice at a time.

Norms are expressed differently depending on the level of the actor - not just who acts, but how those norms are instantiated. The same norm does not look the same at each level. For example, “don’t attack hospitals” becomes for the state, a matter of international law or doctrine. For an organization it becomes reflected in architectural controls, segmentation, and incident response priorities. For an individual, it is represented by ethical restraint and professional norms.

It is at this point we should pause and ask how we can contribute to the establishment of these norms. I strongly believe that the most powerful tool we have is voice. If a nation state attacks a hospital in a war zone, or targets an ambulance (or uses an ambulance to move troops) we express outrage. Headlines scream, international committees form and sometimes even warrants are issued. Does behavior change? Are the culpable held to account? Rarely, but that’s almost beside the point. Norms are expressed and codified and this is for the betterment of society4.

Yet, we don’t see this same outrage when a cyberattack unfolds. Worse, we reflexively blame the victims. But we must stop conflating a defensive vulnerability with a moral transgression. Soul searching is warranted if your EMR system falls victim to a ransomware attack, but surely the true sin is that of the attacker who is placing financial gain over human health and life safety.

How we give voice to an event - with apologies or with anger; wearing shame or giving it - is how we have normalized cyberattacks. And it is with that voice we have the agency of expression.

I want to return to one other element I think we can succeed at - that is, to establish as a norm the notion of mutual defense. Right now, when we talk about helping each other during an incident, or sharing out incident details, we get wrapped around the axle debating incident reporting timelines, liability risks, and PR messaging control. All of these are valid institutional concerns, but we allow this administrative minutiae to obscure a fundamental engineering truth: our multi-institutional technical ecosystem operates as a singular, dynamic system that must be informed and enhanced by collective telemetry.

Rather than provide a single solution to this question, let me frame it as a series of questions for reflection. What specific policy, legal, or contractual constraint most frequently delays or prevents us from sharing incident information in real time? Which of those constraints is truly non-negotiable, and which persists out of habit or risk aversion? If we had to share meaningful incident data within 24 hours, what would break first - legal review, communications, or technical readiness?

Translating these questions into immediate operational realities is where the fault lines appear. What mechanism exists today for rapidly engaging external expertise during an incident - and how often has it been used? If that mechanism didn’t exist, how would we assemble trusted external support within hours? What would a ‘mutual aid’ model actually look like between peer institutions: who calls whom, through what channel, with what data?

To close the loop from expression back to actual norm formation, we have to ask the structural questions: what would it take for rapid, reciprocal incident sharing to become expected behavior rather than exceptional? How would we signal - through our own actions - that we are committed to mutual defense as a norm? What would we publicly praise or criticize to reinforce that expectation across the community?

I offer up this list of questions as little thought grenades, you can pull the pin on them at your leisure if you’re so inclined. But while sharing between colleagues does take place, as I’ve mentioned before, far more than our counsels would probably approve, it remains much more idiosyncratic, often relationship based, and is too unsystematic to even begin to consider norm establishing.

This brings us back to the ontology of expression. It’s easy to look at global cyber norms and assume responsibility lies elsewhere - with nation-states, tribunals, or federal frameworks. But a norm is not a document; it is a pattern of behavior. It exists only to the extent that it is enacted.

For you that means your agency is not abstract. The norm of mutual defense takes shape every time you call a peer to share an active indicator of compromise. It takes shape when you push past reflexive legal caution to share critical telemetry, or when you use your voice to shame those attacking you.

When you choose transparency over posture, you are not just managing an incident. You are engineering the digital commons. You are turning an aspirational norm into something real - something practiced, expected, and ultimately, durable.

Subscribe now

So many of the pieces I post here speak to security and privacy professionals, offering advice on how to manage ‘up’. But often when working with CIOs I find the questions they have equally challenging. Whether you’re new to the CIO role, or at a new institution, starting a position is a terrific opportunity. I’ve tried to use every position change as both an opportunity to reinvent myself (to reflect on my own missteps and shortcomings and try to avoid them going forward) as well as to reframe for my staff and colleagues my approach to infosec and being an institutional actor in general.

For a new CIO to whom infosec probably reports - at least in higher ed - there is also a window of opportunity to have a strategic impact on your infosec program. Now, I can just hear everyone saying “you dope, shouldn’t you just listen to your CISO et al and figure out the lay of the land before requesting changes in the zoning laws?” Of course, but the questions you ask about the infosec program, those very first questions on day one, truly have a long-tail of impact. They’re a tell, your new staff will read and probably repeat to one another for years.

What I want to do is separate what you need to know as a manager with operational obligations from what’s valuable as an executive with strategic responsibilities. The former is going to be concerned with issues of execution: what are we doing, where are the compliance gaps, and what deployment constraints do we have? If your team has summarized these in their Information Assurance Management Plan or IAMP, great! You can read that over lunch and follow up with your CISO during regular meetings. If they haven’t created an IAMP or its equivalent, asking for one is a great step - though I’d do so after working through the more strategic questions.

It is these strategic questions that, as a campus executive, I would open with. As you might imagine, some deal with governance and decision making, but others try to get at many of the concerns I’ve raised throughout this blog. I’ve grouped the questions into four phases:

• What is known? (Phase 1)

• What is testable? (Phase 2)

• What is enforceable? (Phase 3)

• What is scalable? (Phase 4)

The bottom line is that while it’s easy to ask questions that the CISO can discuss but I’d like to turn them into something they must answer, with evidence.

Subscribe now

Phase 1: The Visibility Diagnostic

In phase 1 we want to test whether the program is grounded in telemetry and outcomes, or in asserted capability derived from tool ownership. Essentially we’re going to ask a deceptively simple question: how do you know what you know? More specifically, is the security program grounded in observed system behavior, or in asserted capability derived from tool ownership? It’s far too easy (lord knows I’ve consistently played this card myself) when asked about, for example, email hygiene, to say “well, we have paid some absurd amount for Microsoft’s anti-phishing enhancements.” This is responding to a question on performance metrics with a tool inventory. So my suggested question would be, “what aspects of our security posture are directly measured through system behavior - and what are we inferring based solely on the controls we believe are in place?” This is a difficult question to answer unless performance outcomes are predefined, and answering it forces your CISO to split their answer into one of two buckets: measured vs. assumed. Hopefully it will create some immediate discomfort if everything falls into the second category. Most organizations discover, often uncomfortably, that a much larger portion of their confidence rests on assumption than they expected.

Along similar lines, you’ll want to push your team to define success in operational terms and surface performance gaps, not just activity metrics. With this next question you’ll see that I’ve added in the notion of “under stress.” This hearkens back to my concept of a behavioral architecture by forcing an admission of failure and not just a definition of success. “For our most critical controls, what explicit outcomes are they expected to achieve under stress - and where do we have evidence they are not meeting those expectations?” Notice the subtle shift. We're no longer asking whether we own a firewall or an EDR platform. We're asking what claims we are willing to make about their behavior when they are actually needed. Every engineering discipline eventually reaches this point. Bridges are specified by the loads they can carry, not simply by the fact that they contain steel. Aircraft are certified by their behavior under failure, not by an inventory of their components. Cybersecurity, I think, needs to become more comfortable speaking in that same language

Phase 2: The Architectural Diagnostic

I would note that one dimension to being a CISO is dealing with the multitude of pressures you face with regard to specific controls. Compliance regulations and organizational policy often impose controls and activities of low value for which the security organization has no choice but to implement. In some cases these might even damage your security posture - I’m thinking about obsolete password formation and change policies that auditors love to persist in embracing. Be that as it may, this reality makes it important to distinguish between a security program built on engineering and one built on belief. Every security team develops convictions about what “works.” The question is whether those convictions are actually testable.

The question I would ask to start examining this is, “which core assumptions about our security posture could be wrong today - and what signal would tell us they’ve already failed?” Now there’s a risk to this question. By asking “could be wrong today” and “already failed” there’s an immediacy to the question. Being told by your CISO that some security service, control, or function has already failed is a bell being rung you can’t unhear. It gets at the difficult reality that those expensive security solutions you fought to fund may in fact be obsolete. The treadmill keeps turning.

I have two more questions for this second phase, one on dependency mapping and structural blind spots, and another on feedback loops.

For the first, “can we trace a critical institutional service end-to-end to the infrastructure and controls it depends on - and identify the specific points where failure would interrupt it?”; the second asks, “what is a recent incident or near-miss that caused a permanent change to our architecture or control behavior - and what exactly changed?”

The dependency question tests whether the organization actually understands the systems it operates or merely the technologies it owns. Every mature environment contains hidden dependencies that only reveal themselves under stress. Naturally this works for interrogating your organization outside of security as well. It’ll help surface assumptions (such as once when a power outage took out our data center. The network folks were very proud that all the major nodes had backup power. Unfortunately DNS sat entirely in the primary DC which was down for eight hours. A fuller dependency map would have surfaced this.)

The second question is, I think, a bit more interesting. It determines whether incidents produce structural adaptation or only procedural updates. By asking, “what exactly changed,” you require a kind of precision that eliminates hand waving. It’s very common to look at incidents (be they malware, attacks, or simple IT failures) as point problems. What you’re hoping to engender with this question is for failures to result in a holistic understanding of your ecosystem. By insisting on “what exactly changed” the conversation shifts from documenting failure to engineering resilience.

Obviously I’m dancing around the behavioral architecture idea I introduced in my last post. Behavioral architectures are valuable precisely because they define expected behavior under failure. They don't simply enumerate controls; they specify how the system is expected to respond when assumptions break. Without explicit failure conditions, there is no meaningful architecture - only aspiration.

Share

Phase 3: The Governance Diagnostic

Here I’m going to talk about risk decisions, but as I edit this I’m thinking the better way to frame this is around organizational behavior. Can this organization reliably convert decisions into operational change? I’ve long been struck by our obsession with risk decisions. Canonical thinking about information security rightfully pushes many critical risk decisions high up the organization’s orgchart, and for good reason: risk decisions always involve two elements: resources for mitigation and risk acceptance. Two elements that usually require very senior executives. I recall irritating a CIO I worked for when I insisted on taking an issue to the Provost since the resultant risk impacted the entire academic mission. I felt it was of such broad impact it went beyond the CIO’s scope.

Yet, as every CISO knows, we make dozens of risk and risk acceptance decisions daily. Hopefully we do so with enough savvy to recognize when we’re exceeding our own scope, but this is the reality of being in a security leadership role. Nevertheless, it’s valuable to link decisions and outcomes. So for phase 3 my opening question would be, “where are risk decisions actually made—and what is a recent example where that decision produced a measurable change in the environment?” Asking for an example moves this from theory to practice. Notice the emphasis on “actually”. Every organization has governance diagrams. Those diagrams tell you where authority is supposed to reside. Asking for a concrete example shifts the discussion from organizational charts to organizational behavior. It reveals whether governance is producing operational consequences or merely documenting conversations. Importantly if answered honestly it separates formal governance structure from actual decision authority and enforcement. It opens the door to that honest conversation about risk decisions and risk acceptance that separates the theatrical from the operational.

There’s a lot to plumb around the issue of risk acceptance - but I want to turn to what might be called “exception discipline” for the next question. “How do we track and review policy exceptions - and when was the last time we revoked or reversed one?” Fortunately, I’ve noticed more and more schools codifying a rather rigorous policy exception process; if you don’t have one, you’re behind the curve. For this question, the term “revoked” is the real test, most organizations can’t answer that. But the goal here is obviously one of maturation - you want to move from passive tracking to active discipline. This question tests whether exception management is active governance or passive accumulation.

I want to close out phase 3 by looking at the question of decentralization. “In our most decentralized environments, who is accountable for security outcomes - and how do we verify that accountability is being met?” Notice that I’m still pushing on outcomes over roles, and by using “verify” explicitly, we surface gaps between nominal ownership and enforceable accountability in a distributed environment. This seems like a fairly straightforward question, but in higher education it truly is a can of worms. While it focuses on accountability, it requires deep engagement on issues from outcome and role definitions, system telemetry and visibility, to resource allocation. I suspect anyone wrestling with the management of risk in distributed environments (or defining the distributed IT role in research security) could do much worse than starting here.

Remember, exceptions are organizational entropy. Every exception is locally rational. Yet it’s tempting to say that collectively they redefine the architecture.

Phase 4: The Strategic Diagnostic

The previous phases examined whether the security program understands itself today. The final phase asks a different question: will it still work tomorrow? Strategy is fundamentally about preparing for conditions that have not yet arrived. That means understanding not only where the program succeeds today, but where it will fail as demand, regulation, and adversary capability continue to accelerate.

As regular readers of this blog know, I’m always going to advocate for collective action. When I ask CISOs (or security practitioners in general) about what prevents them from collaborating, the most common answer is that they don’t feel encouraged to do so. What they hear from their management is, “why should we invest your time in helping others when our own challenges are so vast?” is commonly reported. I do think some of this is self-imposed. For the most part, collaboration beyond commiseration isn’t well supported in our community. We seem to lack much of the infrastructure for true collaboration. That makes it difficult to give “just a bit of time.” It’s the self-fulfilling prophecy of not having the time to collectively solve problems so we spend even more time solving them independently. Which is why I think this next question is so essential if we’re forward-looking: “which of our major security challenges are structurally shared with our peers - and what are we doing today to solve them collectively rather than locally?” This tests whether the organization is leveraging a shared problem space or defaulting to isolated solutions. And no, being told “I attended a talk on how some other school tackled this” is not a great response. I recognize that it’s very difficult for a smaller, less resourced school to participate in collaborative projects. The temptation of simply identifying a successful peer and emulating them is overwhelming, and frankly, probably the right move. But even in those circumstances, it is essential that those smaller schools to participate, however modestly, if for no other reason than to make sure their needs are included as requirements. Collaboration by only the wealthy is a country club, not a model for higher education.

Finally, I want to return to the issue of system failures. “Under a step-function increase in demand or threat activity, where does our current model fail first - and how do we know?” I like this question because it forces several admissions. First, the team must identify actual breaking points rather than vague concerns. Every system has a limiting reagent - whether it’s staffing, identity infrastructure, governance throughput, incident response capacity, or simply budget. Second, it requires the organization to articulate what it believes its operating model actually is. Surprisingly few security programs possess an explicit model. Most possess diagrams.

With that, the real opportunity arises. Does that model just show what tools you have, i.e., components and capabilities? Does it simply show where those tools and controls operate, i.e., the topology of your security model? What you’ll want to see is some system-oriented, behavioral thinking. Identifying indicators leading to outcomes: from what exists to what must happen.

I can think of a number of alternative ways to structure the questions, and with it, the arc of your organizational diagnostic. But I like the four listed above, perhaps slightly reworded as,

• Observe (telemetry) - can you observe it?

• Understand (architecture) - can you explain it?

• Govern (decision-making) - can you act on it?

• Adapt (strategy) - will it continue to work when the environment changes?

Which feels to me like more than merely a diagnostic, but a repeatable model.

Ultimately, these questions aren't intended to evaluate a CISO's technical knowledge or even their management of the security function. They're intended to reveal whether the security program has crossed the line from managing technologies to engineering organizational behavior. Every phase pushes in the same direction: away from inventories and toward outcomes; away from asserted capability and toward observable behavior; away from static architecture and toward systems that continue to function under stress. That's the distinction between owning security products and operating a security program.

Subscribe now

It’s useful to reflect for a second on our changing understanding of the human genome. Classically, the genome was thought of as a series of instructions - instructions for creating proteins. As the human genome project was spinning up, there was a palpable excitement that once fully “decoded”, the genome would open the door to understanding the genetic underpinnings of, well, pretty much everything. Got disease X? We’ll track down and modify the specific gene or genes that controlled that. This also fed some of the most recent eugenics trends. All we need to do is figure out which genes made people taller, stronger, and smarter.

Now, of course, while our ability to do genetic analysis is now off-the-shelf, we’ve come to learn that the truth is vastly more complicated. While it’s true that genes do behave largely as understood, it’s not a simple matter of modifying a single gene or set of genes, but it is the regulation of genes that may matter equally. Our body enables and disables genes pretty much continuously, and the nuanced interplay of genes and their regulation is the new frontier. This is to say, our genes are components, but it is the system within which they operate that is where the action is. As the linked article points out, the genome is not the architecture nor a framework, but rather components within the broader, and more complicated, system.

It is this view of architecture as a system, and not a conglomeration of components, that allows this analogy to dovetail with cybersecurity. Or at least, that’s what I’m going to propose. In my last post I noted that unlike math, where a problem is decomposed into simpler elements then is recomposed into stable truths, we in cybersecurity seem to lack an analogous process for our challenges. Particularly those where we want to create a stable architecture for a solution - one that is reusable, and in which failures serve to improve future iterations of the architecture.

I think the shift we should probably make is from thinking of an architecture as a bunch of nouns, to a bunch of verbs. Most reference architectures are essentially inventory lists or compliance checklists. They say, “a mature organization has an MDR service, a PAM tool, an asset correlator, and an incident response playbook.” They define the boundaries of the swimlanes and the existence of the equipment. Rather, I’m going to argue that an inventory list is not an architecture. A real architecture must define system behavior under stress. It isn’t enough to say you have a firewall; you must explicitly claim what the specific, measurable outcome is when a specific failure mode occurs. For our purposes I want to define ‘architecture’ as declared behavior under defined failure conditions.

My suspicion is that my friends and colleagues who are more facile in all matters architectural are going to email me saying, “you dope, of course real architecture does just that. Read a book once in a while.” Perhaps. But I’m appealing here to how the term is actually used in practice. If you go to your networking team and say, “can I see our network architecture” you’ll get a lovely diagram showing network connections and equipment. If you go to your identity team and ask “what’s our identity architecture” you’ll get told about databases holding identity attributes, permissions, and a list of supporting services like SSO or MFA. Inventory lists - valuable no doubt, but nouns one and all1.

Part of what I’m responding to here isn’t the lack of sophistication in IT architecture. A glance at the work of ITANA or even the Educause Enterprise, Business, and Technical Architects community group shows plenty of it. But rather, where it seems to be lacking is within the cybersecurity space. I don’t know if this is because we’ve outsourced creating security solutions to vendors, or we’re all just too busy - my appeal to the defense of The Beleaguered CISO - but what it truly means to have a security architecture must, it seems to me, be more than lists of policies and controls.

Subscribe now

What I’m describing is called a behavioral reference architecture. A behavioral reference architecture does not describe where controls sit, but how decisions are made and enforced across a distributed system2. It defines the signals that matter, the logic that interprets them, and the enforcement points that act on them - creating a coherent, testable model of defense rather than a static diagram of components. I’m going to keep pointing to a fully baked zero-trust architecture as the most commonly understood model. Ironically, the majority of ZT deployments I’ve seen in higher education leave out the most important component - the policy engine - falling back on modest micro-segmentation and gentle NAC in its place.

Most reference architectures describe what should be present, not what should happen. Without explicit claims about outcomes, constraints, and failure modes, they cannot be tested, compared, or improved, and thus never converge into shared engineering practice. As you may have noted in my previous post, it is the lack of codified and shared engineering practice among higher ed organizations that I find disappointing. But perhaps this lacuna is a symptom of this more general failure to develop truly “architectural” security architectures. Ones that meet the definition of what I’ve labeled a behavioral reference model.

Creating these explicit claims (and subsequent tests) of an architecture is, of course, challenging for us in cybersecurity; it’s relatively straightforward to test for the known, but brutally difficult to do the reverse - which is where most of our challenges arise. I’m not even sure what the conceptual language of such claims should be. My intuition is telling me that we might want to borrow from the SRE (Site Reliability Engineering) work done by Google that defines SLOs (Service Level Objectives) and SLIs (Service Level Indicators) for a service. SRE is entirely about how systems behave under stress. Thus SRE defines systems by measurable outcomes and behavior under failure is a first-class concern. But this in a nutshell is our core problem: security lacks agreed-upon SLIs (“blocked attack rate” is not as clean as is latency for a networked service) and of course, security vendors sell capabilities, not guaranteed outcomes3.

I feel obligated to propose some SLOs and SLIs as examples. To push this analogy let’s reframe SLIs as a “SBI” or a Security Behavior Indicator (SBI). If we want SBIs that are observable, time-bound and tied to behavior, not merely the presence of tooling, then examples might be:

• % of privileged logins using phishing-resistant MFA

• mean time to revoke access after termination

• % of endpoints reporting EDR telemetry within last 24h

• time from exploit publication to detection rule deployment

• % of lateral movement attempts detected in simulation

Similarly we can reframe SLOs as a Security Outcome Objective or “SOO”. A few examples of SOOs include:

• ≥ 99% of administrative authentications use phishing-resistant MFA

• compromised credentials are disabled within 15 minutes

• ≥ 95% of endpoints maintain active EDR telemetry at any time

• known exploited vulnerabilities are mitigated within 72 hours

Notice the shift that we have made from “we have MFA” to “MFA behaves this way under pressure.” This is the core of the move from checklists to a behavioral reference model. We are moving from what exists to what must happen. Before the shift, architecture is treated as components (for example, firewall, MFA, PAM), topology (where things sit) and capabilities (what tools can do). After the shift to producing SOOs, architecture becomes explicit commitments about outcomes under defined conditions.

Remember, we are not merely translating metrics but creating operational narratives. For example, if a compromised credential remains active for 47 minutes against a 15-minute SOO, the architecture has failed - not the user. The question becomes: which dependency (IAM, HR feed, ticketing latency) broke the guarantee?

We’ve spent forty years defining what controls we have, and almost no time defining what they must actually do.

I suspect part of our challenge (as security professionals) in viewing our environment as a system is that we’ve fallen back on “defense in depth” for so long. Your nextgen firewall doesn’t recognize an attack and permits it through. No worries, hopefully your endpoint solution recognizes it or its activity on the host. Does that fail as well? Hopefully network segmentation or credential hardening can constrain the infection. And so on, one failure triggering yet another control plane after the other. Essentially, while defense in depth will always remain a wise course, I wonder if we’ve allowed it to become a proxy for robust systems engineering.

As I’ve argued elsewhere, and as a recent article perfectly summarizes, “the root cause of most successful cyberattacks is not a failure of security controls, but a failure of system design.” This shouldn't be news to anyone. If you look at the footnotes of that very modern commentary on AI-driven threats, the source material is a remarkably prescient blog post dating back to 2016.4

Of course that blog and the comment about a '“failure of system design” are referring largely to applications (which are themselves systems). Whereas I’m speaking about the system of security architecture writ large. I would be remiss not to mention, as was pointed out to me by a colleague while discussing this, that computer science has long wrestled with the issues I’m raising, but with much deeper thought and academic rigor5. For the moment though, I think it’s enough to try to formulate SOOs and SBIs if for no other reason than to challenge our usual thinking.

Share

I’d like to pivot the discussion at this point back to the issue of a lack of convergence of architectures within our community, as well as re-introduce the notion of epistemic humility as influenced by what we’ve learned from the drama surrounding Anthropic’s Mythos. Recall that by epistemic humility I’m referring to the fact that our environments are rife with things we don’t and maybe can’t know about them. Everything from zero-day vulnerabilities to unimagined user-behavior. While it’s unidimensional, the takeaway lesson from Mythos seems to be that the quantity of unrecognized vulnerabilities in software is far greater than even the most cynical of us imagined.

For me, some of the significance to this is that because malicious adversaries have the same or similar capabilities as Mythos provides, the attack surface of any security architecture is much larger than we’re prepared for. If an adversary can auto-generate zero-days at scale, your component inventories (nouns) are completely useless, leaving your system's dynamic degradation behavior (verbs) as your only line of defense.

Returning to the challenge of testing an architecture: how are we to test its ability to detect and mitigate an attack when the diversity and breadth of those attacks just expanded by an order of magnitude? There is no simple answer to this, except I see this as an even more compelling reason for our community to converge on the most robust solutions for security architecture and to stop assuming that “which ever vendor we can afford and is popular” is a strategy for success.

As I’ve noted, we have shared references for guidance, e.g., NIST publications and control sets, but we lack a mechanism for shared synthesis of architectural models. That is, architectures that produce consistent and predictable outcomes: SOOs are not defined. I suspect that one reason for this is that our models, our architectures aren’t falsifiable - they don’t converge because they don’t compete.

A falsifiable reference architecture enables comparison across institutions, iteration, and then convergence. That is, “did it work?”, “what failed and why?”, and “this pattern consistently produces the desired outcomes.” Without falsifiability, you get what I described as the diffusion of practice instead of engineered convergence. I’m going to argue that SBIs and SOOs are the foundational metrics that make a security architecture falsifiable. If you don't define an SOO, you haven't declared a baseline that can be proven wrong.

I should probably define falsifiability for those not raised on Karl Popper. Popper proposed that a claim is falsifiable if there exists a conceivable observation that would prove it wrong. Falsifiability has become a cornerstone of the scientific method. Operationally, falsifiability requires someone to define the disconfirming condition, someone to test for it, and importantly, someone to care if it fails.

The reason I think competition is so essential for us when thinking about falsifiability is that without competition, three things happen. First, there is no incentive to test disconfirmation. It’s natural to simply test what confirms our beliefs or, alternatively, to quietly reinterpret failures. Second, ambiguity goes unchallenged - without competition, who is going to challenge you on statements like “the firewall improves our security posture”? This is not crisp nor will it support exploration of questions like “under what conditions does it fail?” Finally, and I’ve seen this far too often both inside and outside of security, failure is socially suppressed. Failures are often reframed as exceptions. Competition, on the other hand, needs not just independent judgment or reputational stakes, but an incentive to find flaws.

Fundamentally, falsifiability is not merely a property of a model, but a property of the environment in which it is evaluated. Without independent actors incentivized to challenge it, even a formally falsifiable claim becomes operationally unfalsifiable.

More simply, without the discipline that competition between security architectures would engender - the discipline to define security behavior indicators and security outcome objectives so that competition is possible - it’s difficult to see how we will ever move beyond the informal diffusion of practice to engineered rigor.

So what should be our next steps? By writing this I’m hoping to seed some thinking about SBIs and SOOs within the security community. I’m also hoping that the technical architecture community turns its eye toward cybersecurity. (And remember, a mature cybersecurity architecture will need to account for non-technical, human behavior as well as the usual adversary/defender binary). What would be a good next step is for us to put some thought into establishing the test harness for falsifiability. No one can write a deterministic, purely technical script to test for the vast, unknown attack surface exposed by AI engines like Mythos but we need to bridge the gap between human systems engineering and narrative simulation.

The closest proxy for a system stress test is the human and administrative execution layer. One option would be to use collaborative, improvisational role-playing exercises as the dynamic test harness6. By forcing mixed-role groups (CISOs, researchers, IT engineers, and administrators) to actively improvise how stress, professional ambition, and trust break down a system, you create a generative model that surfaces unexpected behavioral indicators and system failure points that no checklist could predict.

We also need an open-source repository of behavioral blueprints that declare explicit SOOs. If such an animal already exists it needs to become part of the lingua franca of security professionals. This must include the outcomes from when a model is tested under stress (i.e., when it fails). When an institution experiences a breach, the post-mortem should not simply state “the user clicked a link,” but rather: “Our architecture claimed a 15-minute credential revocation window (SOO), but failed under the stress of an asymmetric identity attack because of a cross-functional dependency gap.”

Cybersecurity seems to be entering a new phase, one in which its function more visibly underpins our entire civic and economic life. In this new phase, the nature of collaboration is also under pressure to evolve. Our collaborations must move from asking “what do we have?” and start asking “what must happen, how fast, and how often?”

Subscribe now

In my continuing quest to find constructive uses of AI, I’ve been reading a lot about how there’s a stratum of mathematicians who feel AI is not only helpful, but a harbinger of how math will operate in the future1. One comment in particular struck me, that “some math problems were more amenable than others to being solved through large-scale collaboration.” This naturally gave me pause and forced me to ask whether this is true for us in cybersecurity and privacy.

Of course, we don’t often talk about our challenges as “problems to be solved.” Instead we have threats to be mitigated, or organizational hurdles that interfere with our ability to implement those mitigations. In earlier posts, I’ve talked about developing a research program for higher education cybersecurity, and I’ve provided my own list of open questions that I believe if resolved, would help steer the field’s progress. But in this post, I want to explore the question of whether some of our challenges truly are more amenable to being collectively solved, or if they are so locally constrained that collective action is unnecessary.

Subscribe now

At first glance, I think the heuristic here is pretty straightforward. Collaboration pays off when the problem is shared across organizations, that is, it has a kind of shared exposure. Perhaps from the same technology and same dependencies. Of course there are problems wherein no one sees the full picture; the image only truly develops when information from disparate perspectives can be sewn together. It should be obvious that anything with network effects benefits from aggregation - the value of the analysis or detection likelihood only increases with participation. And lastly, wherever the attackers scale across victims, i.e., adversarial reuse. All of these are familiar to anyone working at any organization with disparate units.

On the flip side, some problems appear to be solvable without any broad collaboration. I would call out local architecture decisions, or organization-specific risk tolerance and governance matters. And with highly sensitive vulnerability details, collaboration can introduce noise, delay, or risk exposure. But I did say “at first glance.”

As I’m writing this, I’m comparing it to my personal lived experience. Like most professionals, I’ve found sharing and listening to others - be it through a message board, mailing list, or hallway chatter at a conference - to be incredibly helpful. Ironically, it may be more helpful in those items I initially called non-collaborative. Who hasn’t spent time describing a difficulty they’re having with a governance committee, or a local architectural challenge with colleagues? These conversations do normalize practice across the field, albeit slowly. This is more through a kind of diffusion of practice - a passive leak of ideas - rather than a structural adoption of an engineered solution.

But I want to differentiate this kind of collaboration (perhaps snarkily labeled commiseration) from working collaboratively to solve a problem. Perhaps the distinction is therapy versus engineering. Both are helpful in moving you forward, but only one resolves an issue in a repeatable and codifiable way. There’s probably some wisdom here in watching out for the category error of “feeling supported” with “building a defense.”

The first example that comes to mind, of a problem that meets all four dimensions of the collaborative heuristic is building a network border2. Practitioners from outside of higher ed are going to read this and think we’re nuts for ever having to debate it. The traditional functional model many of us have settled on is roughly this for network ingress:

Internet → IP black hole service → firewall → IPS

Ah, I’m feeling nostalgic for simpler days. As anyone who’s older than my dog knows, the scars we earned arguing for that border firewall run deep. At many schools that battle continues because of either cost or arguments about academic freedom3.

But the idea of a network location being a control plane has been eroded to the point of near irrelevance. Increasingly we now think of the network border as porous and dynamic in that it’s highly distributed across cloud, SaaS, your legacy Internet border and endpoints. The border has become secondary to identity and policy enforcement. Of course, what’s interesting here isn’t just what the border is, but how visibility and enforcement move as the notion of a border dissolves4. Even as the border dissolves, the need for a shared model increases, not decreases. Examining this through the lens of the heuristic I provided above we see a distinct contributing factor, that is, shared technology and exposure. Most of us are wrestling with this same challenge and with the same vendors. By the heuristic I outlined earlier, this is exactly the kind of problem that should converge under collaboration. And yet, it hasn’t.

It’s clear to me that we lack some agreed upon approach to this problem. We could look at some of the canonical docs on network protection (e.g., NIST SP 800-41, NIST SP 800-53 SC-7 or AC-4 and of course NIST SP 800-207 which explicitly critiques and evolves beyond perimeter-based models), and I know many of us individually do. But I just don’t see anything passing as a community adopted model. We have references, but not a model. Guidance, but not convergence. Perhaps that’s because we are so loosely federated, there truly is no hub; it’s all spokes.

Equally as possible it’s because we’ve embraced a tad too eagerly the general belief that we’re all special snowflakes. “That model may work for them but they’re richer, bigger, smaller, poorer, less experienced or important than we are.” As idiosyncratic accretions of personalities and preferences, we are all special snowflakes. But I’d like to believe a perimeter is a perimeter (even if we’re abandoning the notion of one).

So we have these canonical architectures, we have decades of experience and shared practice, we’ve had time and commonality to figure this out, yet we haven’t converged on a solution. While it’s true the problem changed shape, it still remains shared. Yet despite everything, we behave as if the problem is local. Perhaps the fundamental issue is that we are treating a collective engineering problem as if it were a local architectural preference.

Share

I suppose we should also ask: are the problems we need to solve in cybersecurity “solvable” in the same fashion as the math problems that kicked off this exploration? We know that a mathematical proof can be solved in more than one way (although often one method turns out to be the same approach in merely a different guise). But unless an error is found, a successful and complete proof is a statement of a kind of truth. The Pythagorean Theorem is a statement of fact: the square of the longest side (the hypotenuse) is equal to the sum of the squares of the other two sides. Is this kind of permanence true for us? Are our challenges truly solvable or merely “solvable given what we currently know of the threats and attack methodologies”?

Mathematicians solve for eternal truth, while CISOs only ever solve for time5. I suspect, sticking with the mathematical flavor, we could posit something like a theorem of cybersecurity depreciation. In cybersecurity our solutions are all born with a half-life. Naturally, this half-life cuts both ways. The ephemeral nature of solutions would seem to work against the value of creating a codified repository - why spend the time to polish and codify something that will immediately begin eroding? Whereas it also suggests that collective intelligence - collaborative analysis and maintenance - would help identify when a solution’s time is up, so to speak.

Another element that stands out in the writing on AI and math is how so much of the work is focused on either discovery or fragmentation. In some cases, an AI is used merely to offer up novel approaches to problems; in others, such as the Quanta piece I cited, the work begins by breaking a problem into a large number of smaller pieces, lemmas, the atomic components of the larger molecule of the theorem. It’s tempting to think that the market is taking care of the latter for us. Every vendor tackles each functional component as an element to be optimized. However, even in integrated solutions, such as nextgen firewalls that combine traditional firewalls and IPS functionality, that integration is more of a papering over of the edges. The UI tries to smooth over the reality that you have two products in the same chassis. These don’t solve a single problem, but present several solutions that are conveniently bundled into one SKU6. It’s tempting to argue that attackers optimize for reuse while defenders optimize for procurement.

At its core, math’s use of AI involves breaking a problem into its atomic components, which are individually proved, then recombined to form stable truths. Whereas in cyber, vendors control the decomposition, but no meaningful recomposition takes place, and what results we have rust over time. Addressing this may be much more impactful than any specific engineering-centric challenge we face. What would decomposition and recomposition look like for cybersecurity problems, and how do we recapture this space from the commercial marketplace - or at least influence it?7

I’ve been overextending the network border challenge but I can think of a few other narrower examples. For instance, if one university sees a handful of suspicious emails and another sees similar domains registered while a third observes credential harvesting endpoints, each sees mere noise. But collectively we see an early-stage phishing campaign developing. Thus, this meets heuristic number two, distributed visibility. Only by working collaboratively does the full image resolve as the telemetry is correlated.

Similarly, ransomware attacks seem to fit heuristic number four, adversarial reuse, whereby the attacker scales across victims. With most ransomware we have the same tooling reused. I’m thinking of highly commoditized frameworks like Cobalt Strike, credential harvesters like Mimikatz, and living-off-the-land binaries. It’s common to see the same attack chain, from phishing to foothold to privilege escalation to backup targeting. And of course, they show the same monetization patterns at each victim. After all, attackers want reuse because it lowers their cost. That means, however, that defenders can amortize detection and response across victims. Thus, we develop a shared understanding of the entire detection chain, not merely IOCs. This should lead to shared incident response playbooks, and preemptive control placement. But again, only with aggressive collaboration.

All of this is to say, that while vendors sell individual, fragmented lemmas (SKUs) that offer cosmetic integration, the actual threat landscape is highly integrated, repetitive, and optimized for scale. If attackers are amortizing their costs across victims through reuse, defenders are practically committing malpractice if they don't amortize their defenses through collaboration.

So why is it that despite our shared ecosystem, our shared experience, our shared references (NIST et al), we lack shared synthesis mechanisms? Why is it that within the institution of higher education cybersecurity practice, there is no institutional mechanism for turning shared experience into shared architecture? Lord knows it’s not for a lack of venues. We have consortia and conferences, national, regional, and local; we have all the modern tools of communication and collaboration available to us, yet with few exceptions we lean into commiseration and cultural osmosis over engineering8.

The wisest manager I ever worked for once, no doubt when I was justifying some procrastination on my part, dope slapped me with “people do what they want to do.” Advice that helped me be a better manager myself, but forced me to do some serious internal reflection on my own decisions. Which returns me to my opening question: Which problems should be collaboratively solved - and what should we do about it?9

To be sure, the broader barriers to collaboration often appear structural. We look at the landscape and notice a missing hub - the lack of a dedicated project owner or central catalyst to drive a community-wide initiative. But this absence is largely self-inflicted. In higher education, we wear our decentralization and institutional federation as a badge of honor, and we project that fierce independence onto the very organizations we establish to help us. Consequently, our collective bodies are designed more to facilitate polite communication than to execute rigorous collaboration.

Similarly, our lack of common metrics is a calculated omission. Defining hard security metrics is notoriously difficult, but it also threatens to decrease our local degrees of freedom and challenge our subjective preferences. Even our shocking lack of an agreed-upon, curated repository of solutions is less a resource constraint and more a defense mechanism. I view all of these structural gaps not as the root cause of our failure to collaborate, but rather as the visible artifacts of our unwillingness to converge. In the end, we do what we want to do.

I’ve provided a simple heuristic for evaluating challenges, but I suspect the failure to build a collectively engineered defense is fundamentally a failure of will and culture. In our relative isolation, it’s simply too easy to forget that the larger culture of our profession isn’t something that exists independent of us. Culture is an emergent artifact of the millions of small choices we make in our daily lives. We choose our own wardrobe. Perhaps we are also choosing fragmentation over convergence.

Subscribe now

The past and present wilt—I have fill’d them, emptied them.
And proceed to fill my next fold of the future.

I don’t think Whitman would have made much of a CISO. We struggle precisely because we live at that juncture between the past and the future - existing practices and planned ones. Our present is almost impossible to empty; for us, the present is little more than the accumulation of past practices we firmly grasp, fearful of letting go of what was won with such difficulty. We hoard the past, and in doing so we constrain the future. What was hard-won becomes untouchable, and the result is not stability but inertia - an environment where new approaches struggle to take hold because the old ones are never truly released. Our resources are finite, yet our desire - our need to respond to new threats - is unlimited.

In this post, I want to reflect on the issue of balancing historical practice with new demands, through the lens of the term security practice registry, and three possible definitions for it. Each offers a similar but distinct framing for historical practice that can help inform and guide future actions. Each definition expands the scope of the registry - from institutional memory, to sector coordination, to ecosystem trust.

Subscribe now

Let’s start with the control plane. In this framing, a security practice registry acts as a centralized authoritative database where the organization logs and tracks exactly which security controls, policies, or practices are active across various units. It asks “what are we carrying?” In one sense, it is an institutional risk and governance ledger. For most of us, especially in higher education, this is the space where GRC tools live. At a larger scale, globally matrixed corporations use continuous controls monitoring platforms - I’m thinking of a tool like Panaseer (which I have no personal experience with). In this market, the tool logs both vulnerabilities and whether specific controls have been implemented in discrete business units across the enterprise.

What’s lovely in this approach is that instead of a generic compliance checklist, this registry maps reality. I find this attractive because it articulates what we’re actually doing (and where) even if it rarely touches on why. One need not “speak truth to power” but simply describe the situation on the ground. Observation over analysis.

Alternatively, we can view a security practice registry as a form of collective telemetry, a sector-wide defense repository. It asks “how we compare and calibrate?” When applied to a community or industry sector (like a sector-specific Information Sharing and Analysis Center, or ISAC), a security practice registry functions as a collaborative blueprint. Rather than sharing volatile threat intelligence data like changing IP addresses or file hashes, organizations use a registry to share their structural defensive postures. It catalogs the specific configurations, architectural designs (such as protected, anonymous networks for research), and mitigation steps that peer institutions are successfully deploying against targeted threats. It allows a sector to baseline what “best practice” looks like in a complex environment. But caution is warranted; do not confuse comparative and normative risk1.

Finally, we can continue our outward expansion to define a security practice registry as a supply chain and software registry architecture. Here we ask “what we unknowingly import into the future?” In software engineering and DevOps (such as managing open-source package managers like npm, PyPI, or DockerHub), the phrase refers to the security protocols enforced by a platform registry. This includes logging cryptographic signing practices, verifying software provenance (like Software Bills of Materials, or SBOMs), and ensuring a transparent, auditable trail of code custody to prevent software supply chain attacks.

For each framing we have plenty of examples, the ones provided here are merely illustrative. GRC and CCM tools serve as the institutional risk and governance ledger. Sector-wide telemetry emerges through platforms like CIS CSAT, MITRE ATT&CK Mitigation Matrix, and D3FEND, which encode shared defensive patterns against common threats. At the supply chain layer, Sigstore, OpenSSF Scorecard, and secure container registries (e.g., Docker Scout, AWS ECR) extend this logic outward, enforcing provenance by requiring artifacts to map to SBOMs.

One object class, “security practice registry”, three different instantiations of the object, each with differing properties, but all three offer value to us as security practitioners. More plainly, all three of these at first glance look like mere technical artifacts, when in truth they serve as governance primitives. That is, they shape decision-making by structuring visibility, not by prescribing action2. Collectively they ask “how does this help us decide what to keep versus discard?”

Share

It’s worth pointing out that by calling these governance primitives, I’m using “governance” in two ways. The immediate conclusion is that it refers to formal institutional governance processes - and that’s correct. But it also refers to the kind of managerial governance we exercise over our office activities, the agency our organizations have invested in us as practitioners. I won’t fully untangle this knot here, but it is worth reflecting on how to balance those two domains of governance. I suspect that for expediency, we all try to expand the latter and minimize the former. In reality, the decision tree for this is cultural and organizational, and not a function of expertise or practice logic.

Be that as it may, by using these artifacts - these three forms of registry - to inform governance decisions, we begin to wrestle historical and current practices to the ground. They show us where and at what scale actual risk exists within our ecosystems. Importantly, each reveals a different type of risk.

The supply chain and software registry is largely a risk of the unknown. It shows us gaps in our knowledge (or at least visibility) about the products we introduce into our ecosystem. An incomplete SBOM or a poor Scorecard measure suggests the need to more deeply interrogate a product. Being an outlier in the space of collective telemetry could mean you’re the only one doing something right. But more likely is that you’ve recreated the wheel or fallen down a rabbit hole. Innovation and creativity are valuable but sometimes you just need to use a hammer, and not engineer a nail insertion protocol. Here the risk is that delta between you and the rest of the world - a signal that needs explaining. This is the risk of isolated deviation. While our scientific workflows are uniquely open, the underlying technical primitives - identity management, network routing, credential storage - are not. Conflating unique research with unique infrastructure is how we fall down these customized rabbit holes.

Of course, the institutional risk and governance ledger gives you a literal map, the topology of practice risk in your organization. It allows you to ask “why isn’t MFA being used in a specific unit?” or “why does one research lab have 80% of our policy exemptions?” True, this is not the same as the classic risk register, i.e., an inventory of threats, but it reveals where we are weak thus showing where resilience is lacking. I would label this the risk of permeability, where your internal enterprise fabric is structurally thin.

Exploring the notion of a security practice registry reveals a reusable model where risk visibility and governance influence are emergent properties. What I find attractive in this formulation is how we can use one mental model to surface multiple forms of risk. This allows us to shift the past from a burden to be carried to a tool to inform planning and governance. In evaluating this or any model we should always pose the question, “what does this let me ask that I couldn’t ask before?” Critically, this model creates visibility and thus a pressure to act. But governance determines whether that action is thoughtful or reactive. Visibility is not the same as wisdom; registries create the former, while governance must supply the latter.

Whitman believed that to grow, a person must possess the radical capacity to shed their former selves, their past mistakes, and even their hard-won achievements. If you keep your vessel full of the past, you have no room to receive the future. History should no longer be a weight holding us back, but through the use of practice registries it becomes a ladder helping us better survey our landscape and make future decisions based on that wisdom. History becomes the embodiment of traceable wisdom3.

Subscribe now

… how do we address the need for this important and non-public threat intelligence? Second, how to prevent the penetration into systems and the theft of data by the US Government. Given the legal instruments available to the government what technologies can assist in protecting PII and private communications? Or more broadly, entire targeted groups?

Where to begin?

In this post, I will address both of the questions raised by open question no. 8, more fully “the untrustworthiness of the federal government.” Both are inflections of the more general question of how we, as the higher education community, should respond to the behavior of the Feds. While I’m framing this as a federal issue, the collapse of the SCOTUS has allowed a number of states to ‘get in the game’ of suppressing academic freedom - Texas in particular stands out - so what I’m proposing here needs to work regardless of where the suppression arises from1.

As IT practitioners there are two dimensions to academic freedom we need to discuss. Naturally it’s tempting to delve into the nature of - and frankly limits on - academic freedom. Importantly, academic freedom is not bounded primarily by content, but by context, role, and impact. Is the speech within the scope of professional expertise? Does it interfere with institutional function or violate law/policy? Does it meet the norms of the discipline2? While academic freedom is largely a framework of self-policing norms, its weakness under the current onslaught is that it simply never was codified in a fashion to resist a governmentally driven politicization. Academic freedom is often protected by institutional policy, but that and 50 cents won’t buy you a cup of coffee these days3.

I should note upfront that my proposals below don’t really address “protecting the right to academic freedom” but rather they “protect the activity of academic freedom as practiced by academics.” Essentially we want to preserve the advancement of science and the privacy of thought, despite the legal barriers being erected around them.

But I want to start with the question of how institutions should respond to the weakening of Federal threat intelligence - which has been achieved both by eliminating traditional resources and, more perniciously, by changing the identification of “adversary”. Then I will return to the question of protecting academic freedom.

Subscribe now

Let’s begin with how our community can respond to the absence or weakening of Federal resources for threat intelligence. As you’ve undoubtedly noticed I often argue for community-centered action in response to community-wide threats. Which is precisely what I want to do here. We simply do not leverage the telemetry our scale affords us. Even if we were to focus on only the RUCC4 or AAU schools, collecting and correlating attack and probe information would be formidable indeed. Think of this as a strategy for sector sovereignty.

I have to confess, I have at times been skeptical of such an approach. Our commercial providers already collect this data at a much larger scale and many of us already buy this aggregation either independently or as part of a technology bundle. Further, I saw how difficult it was to build interest in such an effort when I worked within large systems. It was also hard to see the lack of interest and uptake of the REN-ISAC’s MISP service (and its predecessors) without reaching the conclusion that commercial options were largely meeting community needs5.

Nevertheless, there are several reasons to pursue a sector-based threat intelligence initiative. While I’ve long been struck by how poorly we articulate precisely how we are distinctive from other sectors in terms of the attack mechanisms, the question I have is this: if we can’t articulate our uniqueness as a sector, either we’re not a sector at all or this reflects on our own self-awareness. We either are something, or we’re not. And if we are, then what are the attributes that define us?

It’s easy to assume that the usual metaphor of universities being more like cities than businesses is correct. But that sort of works against us in the cyber realm. There are over 19,000 cities in the US, around 350 with a population over 100k. Yet no one I know of leans on cities as models to emulate for cybersecurity governance or operations. We use that metaphor with our management to differentiate ourselves from commercial businesses who, ironically enough, make up the bulk of every city.

If our heterogeneity of function doesn’t differentiate us, what does? One obvious distinction is the role and scale of the student population. While online-forward schools such as ASU or the University of Phoenix may treat students as businesses treat ‘customers’, for more traditional four-year and community colleges, students represent both constant change (with a class entering and exiting every year) and a flexibility of roles. Many, if not most, traditional students are also employees at some point in their education. But does this represent a distinction with regards to our cyber posture? I think so - it requires us to allow unmanaged, non-enterprise systems to have access to enterprise administrative accounts. It brings tens of thousands of systems onto our “corporate” networks and with it, risks that need to be addressed.

But threat intelligence is primarily about the threat, not our risk surface. Is the profile of the threat surface attacking us truly different from what it is for any other business? Surely a great many attacks are what we can call opportunistic: launched broadly across broad swaths of network addresses, hoping to find a soft underbelly. I doubt those represent any sort of targeted attack unique to higher education. It is true that our research activities may be subject to targeted attacks, but outside of a handful of fields (e.g., quantum, biomedical, materials science), it is unclear whether these are driven by the intrinsic value of the IP itself or are better understood as part of sustained campaigns of capability-building aimed at advancing nation-state competitiveness.

My suspicion is that actionable threat intelligence, that is, actionable and valuable to our community, emerges not from examining either the threat profile of the attackers, or our internal risk surface, but rather from the intersection of these two. Our unique posture of vulnerability wrought by our federated administration, churning student population, the entrepreneurial nature of research, and our hands-off approach to securing it, creates a profile of successful attacks. My instinct and experience tell me it’s unlikely any one of us, even at the larger institutions, see enough data to fully form that profile. Commercial threat feeds remain valuable, but they fundamentally lack our context. Each of us is like a piece of a hologram that has been shattered. We see the full image but only at lowered resolution. Only by assembling the whole does the image sharpen up.

Ultimately, this is why I’ll continue to argue for higher education to act as a sector with regard to threat intelligence. Politically it positions us by demonstrating agency and maturity. Practically it may be the most effective response we can muster to the erosion of Federal sources of threat intelligence.

Share

But some problems require more than signal aggregation, others require a less observable surface. Thus, I want to return to the other dimension of protecting academic freedom that I promised to discuss above. Instead of the sovereignty of our sector, think of this as individual sovereignty - protecting the person. As I’ve written in other pieces about the primacy of privacy as a necessary condition for academic freedom6, I believe that it is increasingly unlikely that any digital manifestation of thought work is free from surveillance. This has taken on a new urgency to address with the openly hostile attacks on academics and academic institutions by the current administration and its allies.

Like a knot that tightens when you pull on it, schools cannot openly admit to trying to solve the problem of protecting academic freedom. To do so only makes the situation worse. There is no magic solution given the hostility of the government to open discourse and research that runs counter to a racist agenda, or that challenges skepticism around climate change or vaccine efficacy. Yet, as technologists there are steps that can be taken.

I’ve discussed two previously. First, the creation of fully protected and unmonitored networks for ideation and research - a network architecturally designed for anonymity. Second, that we systemically revisit how library materials are searched and accessed to ensure untraceability. Neither of these are terribly difficult engineering problems, but they do require an institutional response. Neither is truly achievable without institutional adoption.

The third possibility - born of watching how targeted communities function under totalitarian and repressive regimes - is the availability of user-managed encryption tools. The most famous of these was PGP7 though no doubt better options exist these days. As someone who’s worked for a central organization my entire career, I always avoided recommending these user managed encryption tools. They have a sharp edge - without central access to the decryption keys, it’s just too easy for a well-intended faculty member to permanently lock themselves out of data or a system. That risk still exists, but I think the risk / reward balance has shifted. Imagine the world we’ve awoken in: simply stating “perhaps we should study the effect of racism on minorities” is sufficient to get you banned from Federal funding or fired from your job. Despite the expanding use of AI within scientific research, I wonder how many of our faculty question the risk they’re exposing themselves to by interacting on research topics with LLMs8. This may be the modern manifestation of the ‘gaze of the observer’ on modern research.

When I started this series I had intended to focus this piece on how we, as an industry, could respond to the current political crisis. But it’s increasingly clear that we’re not organized for that fight. We write pleading whitepapers, we make elegant statements on the centrality of higher education and its research mission to the national health and competitiveness. But we operate on the assumptions that the norms of behavior and reason are still in effect, when they’re not. Slowly, it’s becoming clear that in one sense, all that we have assumed about the progression of society, science, and modern democracy, has been at the largess of a functioning government - something we utterly lack. Nothing prepared us, as one example, for a government capable of issuing mandates to reduce the number of vaccinations children receive.

Thus, it seems we must look inwards, to actions we can take ourselves as individuals, institutions, and a community to protect the core of our mission. A final note. You may notice that on one hand I’m arguing for collective, sector-wide coordination in cyber threat intelligence, while on the other for individualized, decentralized safeguards in academic freedom. It’s worth asking why one problem is solved through aggregation and the other through fragmentation. I don’t think the answer is any surprise: one requires visibility, the other deniability - a shared signal versus personal protection. But that dichotomy struck me as I was finishing this post, and it’s probably one worth reflecting on as we continue to react to the changing world around us.

Subscribe now

I’ve created a lot of strategic plans over the years and they’ve evolved quite a bit as my own experience and sophistication about ‘strategy’ have grown1. I’ve written a fair amount on this blog about strategic planning as well. I’ve also talked quite a bit about the notion of trust and collaboration, developing trust with your community and collaborating with partners who have shared concerns. We have librarians and educational technology specialists, for example, who both create risk (by standing up new technologies and services) and try to mitigate it through policy and practice. In a healthy institution, these and other constituencies work together. But we still often stay focused on our swimlane - our service or our infrastructure - and we lose sight of the pool.

Reflecting a bit more about the recent Canvas incident that I posted on last week, however, got me thinking about the nature of strategic planning and its impact on resilience. In this post I want to ask the question of whether we need to think more broadly about strategic planning: to change the scope from “cybersecurity” to “institutional resilience” and if so, what that might mean for how we do strategic planning for information assurance.

Subscribe now

You see how I brought that broader term, information assurance, back into the discussion. Recall that I define information assurance as an umbrella term that encompasses several distinct yet highly interdependent areas of expertise. These core domains include cybersecurity, privacy, data protection and curation, risk management, and resilience. I do this because I think it’s an excellent gateway to thinking about an organizational strategic plan, and not merely a cybersecurity strategic plan.

Now some of my cybersecurity brethren may be saying “you dope, of course I worry about items like privacy and data protection, I see the scope of what I do as touching almost every aspect of the institution - as you yourself have argued.” That’s wonderful if you’re doing that and I’ve seen many of my peers include these in their planning efforts. But let me ask the question a different way: if someone were to ask your privacy officer, your enterprise risk manager, your registrar or your librarians what role they play in institutional resilience, would they point to your strategic plan or to their own? And if the latter, what exactly is coordinating those plans when the system is under stress? If you framed the question using the term cybersecurity, they might at least acknowledge you. But in many organizations, regardless of goodwill and collegiality, everyone stays head down in their lane, just trying to remember to not bump into the edge of the pool with their head.

More to the point - while your senior executives no doubt expect the CISO to be on point for cybersecurity matters, and the CPO for privacy matters, given the entwined nature of digital systems and business functions (including research and instruction) who will they turn to for addressing mission continuity under degraded conditions? While I would want my facilities staff to be prepared to respond to a tornado destroying a building, and my cyber staff to respond to a ransomware attack, the reality is that everyone would be involved when classes are disrupted or health is put at risk2. As many schools learned from the Canvas incident, regardless of where a problem arises, a rapid and effective response requires marshaling a small army, not a unit. Similarly, proactively building the resilience to weather a storm requires that same army preparing in advance, far more than simply working out an incident response plan. You’re not looking for “incident response” but adaptive capacity across functions.

Let me put this more bluntly: I’m proposing that a mature institution will take a digital equivalent of an “all hazards” approach to cyber risk and ensure that a singular organizational strategic plan is created that addresses the totality of information assurance. Creating such a plan involves more than simply including various stakeholders in each other’s plans - that’s what we euphemistically call ‘coordinating’. In practice coordinating means “develop your own plans but meet once in a while for input.” What most institutions call “coordination” is not integration, it’s parallel planning with occasional conversation. Each domain develops its own strategy, and we reassure ourselves that alignment exists because we meet periodically. It doesn’t.

An “all hazards” approach, taken seriously, requires something much more demanding: a single, integrated strategic plan that treats information assurance as a system, not a set of adjacent functions. This is not about inviting more stakeholders into the room; it is about abandoning the idea that cybersecurity, privacy, data governance, and resilience can be planned independently at all.

Such a plan must cut across the boundaries imposed by the org chart and instead organize around collective risk and continuity. Otherwise, we are not building resilience, but rather, we are coordinating silos.

Share

I can just see the eye rolls taking place as you read this. “You dope, strategic planning is already complex enough, now I need to throw it out and scope it even broader?!” Well, sort of. Naturally, there’s still a need to do functional planning, both tactical roadmaps and strategic plans. If you manage some function - library data curation services, online instruction and pedagogy, privacy, or security - then you need to establish goals and roadmaps that will guide your programs. But the institution will be weaker if it lacks a plan that acknowledges and addresses the system of information assurance. So what barriers and what opportunities are there for moving forward?

Some of the barriers are pretty obvious: leadership and budgets reflect org charts and different functions are intrinsically more expensive than others. Technology costs and market forces dictate that your 20-person security team is going to be more expensive than a 20-person library data curation team, or a 20-person educational technology team3. Greater costs imply greater resources which lead to greater capabilities, and that changes the flavor of strategic planning pretty directly. We must acknowledge a harsh operational truth: money dictates and reflects political gravity on a campus.

I suspect this cost asymmetry can be somewhat mitigated by staying focused on the goals - the what you’re planning on doing - rather than the how. Perhaps your goal is to ensure instruction can continue despite a 24 hour disruption to internet or LMS access. The plan can then detail who has to prepare for that and point to activities in their work plans. Use the strategic plan to inform and guide your operational roadmap, but avoid turning it into one. This is the hardest part of every strategic plan.

But even more so than leadership and budgets, I think a bigger challenge is a lack of models for this sort of planning. The only place I’ve seen this tackled is the material produced by risk management offices - the canonical source for “all hazards” planning. But these don’t seem to be adopted, modified or not, into cyber risk management, especially in higher education4. Cybersecurity plans are driven by IT infrastructure, data curation strategies are bound to the Library, and privacy initiatives are dictated by the cudgel of compliance5. Even institutional strategic plans often struggle to do more than offer motherhood and apple pie references that point to a siloed function’s subsidiary plan.

When I think of a strategic plan that addresses risk, I think the product is the process. The lasting value comes from surfacing risk - that sunlight is the best disinfectant. An organizationally scoped strategic plan will illuminate for leadership that, for example, the risk from ransomware isn’t just a concern for your IT and cybersecurity teams. It’s an issue for procurement, for researchers and educators, regardless of where the ransomware lands. This is to say that the process of creating the plan brings transparency to the question of where risk is and how it’s mitigated. I am arguing that this is at least as important as, if not even more important than the plan for action itself. It’s the acknowledgement of a problem necessary before recovery is possible.

The plan does matter though. An effective plan should drive the creation or refinement of your continuity of research and instruction planning efforts. It should help cut through the roadblocks of control, ego, and status. But let me say something about this head-on. I think part of why many of us struggle to achieve the kind of collaborative planning I’m suggesting is precisely because it requires not relinquishing control, but sharing it. Of course I can only speak for myself, but I know many of us frankly resent or at least dread sitting across a table with individuals we don’t truly respect as experts as they suggest changing how or what you should be doing. You’re the senior cybersecurity administrator, and you’re the one who will be held accountable when something goes wrong. I’ve seen this same issue and reluctance from privacy officers when the cybersecurity team treats a major PII exposure as merely another security incident. I’ve seen both teams actively hide events from the other.

You work hard to maintain and manage your span of control, and sitting down with others in cyber-adjacent fields can feel awkward. I’ve no doubt those in these adjacent domains are having the same thoughts. They may cede to your cybersecurity expertise, but would bristle at being told how to manage their instructional services (for example). Rightfully so. What I recommend is that you use that tension as a barometer. If the tension is too high, then either someone is wandering too far outside of their expertise or you’ve identified an area that needs examination. In either case this needs to be the dead fish put on the table - the unsaid conflict that everyone can smell but nobody wants to name. Ask yourself, what decisions and how governance will be impacted or be changed by exploring that issue.

Remember, you’re still going to want to have a cybersecurity strategic plan as the head of cybersecurity - but the institution needs that information assurance strategic plan. Institutions mis-model risk because they plan along org boundaries rather than system dependencies. As I’ll argue shortly, if you want to address asymmetric accountability you really have to go past those organizational boundaries.

There are a lot of opportunities in this approach. Fundamentally you want to move from planning for control within domains to planning for continuity across dependencies. You are reframing the unit of planning: from functions to services. Right now, plans are owned by functions (security, privacy, libraries, IT). The opportunity is to shift the unit of analysis to institutional services. This is not merely cosmetic in that it forces cross-functional dependency mapping and with it shared ownership of outcomes. A consequence of this is to make dependencies a first-class artifact. As we saw with Canvas, most institutions do not know what they’re dependent on. This means the real opportunity is to treat dependency mapping as a strategic deliverable, not a technical exercise. Thus we are elevating continuity from IT recovery to mission continuity and can answer questions such as how degraded can instruction be and still function? What research activities are time-sensitive versus restartable? What administrative functions must remain real-time?

The institutional opportunity that may appeal to your leadership is that this sort of analysis can lead to rebalancing institutional investment based on exposure, not tradition. As we all know, inertia and momentum are the biggest challenges to institutional evolution. They’re part of what enables an underinvestment in research resilience, vendor risk, or identity.

Earlier I suggested using discomfort to inform decision making. This is not easy, but if successful you’re turning cross-functional friction into signal, not noise. We overlook these opportunities so often, as when we hear user complaints about security measures as resistance rather than feedback. Once you start looking for it, you find this tendency manifest in so many parts of IT - and I suspect the same is true in many units that support staff or students.

Ultimately, and perhaps most important, we want to create a shared risk narrative for leadership. Rather than receiving fragmented reports and metrics, the opportunity is to produce a coherent institutional risk narrative, where cybersecurity, privacy, vendor risk, and resilience are presented as one system. Where the trade-offs are explicit and the dependencies are visible. This is what enables actual governance, rather than episodic reaction.

On a very practical note, I want to mention a final opportunity, that of mutual support. Presenting annual work plans that include activities involving other units - and for them to do the same - demonstrates two things to your leadership. First, every large organization suffers from operational friction wrought by redundancy and over siloization. Family squabbles so to speak. Addressing issues at the larger institutional scale is a sign of maturity and selflessness. It is always appreciated. Second, and more important in the long run, it reinforces to your executives that the risks each of you wrestle with are not limited to a functional unit. That all the elements of information assurance are risk centers that affect every corner of the institution. With this you are coaching the institution to think holistically, and realistically, about risk.

I’ve spoken a lot in this post about continuity - business, research, and instruction. The real challenge here is to lift your head from the water and realize the pool is the real focus of your attention; it’s not a race, nor languid training laps. I suspect of all the challenges I’ve outlined, it isn't a lack of templates or asymmetric budgets - it’s the discomfort of sharing control that stifles us. The maturity of a CISO or a CIO shouldn't be measured by the size of their span of control, but by their willingness to share it to protect the institution's mission.

The real constraint is not frameworks or budgets but the psychology of shared control and asymmetric accountability. Remember, shared control implies shared accountability and this produces better governance decisions under uncertainty.

Subscribe now

I had hoped to avoid saying anything about the Instructure ransomware event. It’s getting so much press at the moment, and honestly I haven’t reached out to any contacts to even try to find out what really happened. I’m assuming people smarter and more connected than I am are putting pen to paper and I’m sure some point soon we’ll learn the nitty gritty of what happened. Was this a serious case of sophisticated hacking? A self-inflicted wound? God help me if it turns out to be “some contractor’s laptop” or “a rogue developer’s unprotected account.”

I do, however, want to take a moment for a long overdue self-reference. In one of my first national publications, I think it was for the Chronicle, I referred to our campus provided services as “dinosauric”. Mysteriously the editor didn’t try to make me change it. This came to mind as I was reading a short Atlantic piece on the Canvas incident from the perspective of a faculty member. While the article itself is a fun read, the real meat and potatoes are the comments. For me, the money shot is this comment (italics are mine).

I taught at a college that used Canvasas's [sic] competitor Blackboard. It was so clunky, especially in grading and rubrics. For most of Blackboard's functions, I set up a parallel system on Google Docs and through gmail. That saved me tons of headaches. It also made it easy to deal with a courseware outage.

On one hand, this can be seen as a testament to human ingenuity; on the other, it’s a sign of how dinosauric our enterprise systems can be. This workaround - or some flavor of it - will be all too familiar to anyone who’s worked in higher education, either academically or administratively1. It’s also just as likely to reflect the rule of thumb that people would prefer to use the familiar rather than train themselves to use the unfamiliar. I wouldn’t at all be surprised if the parallel system described is far more labor intensive than the designed system it’s replacing. Human nature being what it is.

Subscribe now

Browsing the comments one sees a wide spectrum of beliefs on display: the attitudes range from smug “tech-skepticism” to pragmatic defense of progress, all tied together by a shared resentment toward clunky enterprise software. Some comments focus on the lack of agency students and faculty felt when the system went down. That “the system” is the law - without it only failure remains. Others point to the “management vs. learning” divide, convinced that a learning management system (essentially an administrative front end to a course) has been forced on them as a proxy for the good old days of faculty to student connection2.

A few comments go down the path of inevitability and incentives. Since institutions are stuck with these terrible systems, providers have little incentive to improve them. My own take is that while this may be broadly true in a monopoly context, I think the real challenge is deeper than this. And of course, a common thread through many of the comments is pragmatism vs. nostalgia. Many long for the past of small to modest classes, classrooms with little technology, and only the strength of faculty personality animating teaching. Others recognize that while these modern systems are flawed, they’ve permitted the delivery of courses to millions who would otherwise be unable to attend college.

There are a number of takeaways from this incident and the comments to the Atlantic piece. First, I think it’s a beautiful encapsulation of how enterprise IT is viewed by faculty, who are the very engine of the institution. Granted, this isn’t comprehensive data captured by rigorous surveys, interviews, or analysis. It’s a modest number of Atlantic readers who bothered to post a comment. But it does sound and feel awfully familiar to someone who’s spent their career in academia.

Nor is it clear that a great solution exists. Every school wrestles with these hopeless and hopelessly expensive systems - ERP and educational - and none of them are really any good. The delta between tech as experienced IRL and at work just keeps burning user goodwill, despite the obvious improvements these systems have made over the years. I can bank, plan a trip, buy tickets, book hotels, order food, and date with my thumb, but filing an expense report or checking the results of an exam tests anyone’s patience.

In a previous role, the CIO had promised the senior administration that a new ERP would be better and cheaper than sliced bread. Since they trusted me, I was quietly invited for a conversation about the matter. I told them the truth: the new system would be hated, more difficult for staff than the finely honed existing system, but that this would lead to a workforce refresh as the older staff retired and were replaced. It would cost 2-4x what they were told - but, the market simply didn’t offer many alternatives. Just different flavors of ‘meh’. I also said it was necessary since the old system was rapidly becoming unsupportable. In the market of higher ed ERPs, we weren't buying a solution; we were buying a decade of slightly more modern debt. I suspect this paragraph is as true now, and in the future, as it was then.

So you can see that enterprise IT shops are between a rock and a hard place. This is truly the deeper challenge I alluded to earlier. No one is going to hand you the tens or hundreds of millions it costs for these systems with that as the system précis. Be that as it may, it’s essential that IT providers understand how their offerings are viewed and give a damn about it. Woven throughout the comments are a number of ideas that simply aren’t true and should be subject to a deliberate and sustained effort to correct. The beliefs and attitudes are the lived experience of the faculty and cannot be dismissed - but the narratives shaping them can be changed. I recognize that many in IT will see only the naïvete in the comments. But I would argue that to do so is to ignore a valuable source of feedback from an essential community.

Share

The next takeaway brings us back to the incident itself, or more precisely, our dependency on providers who inevitably will suffer incidents. Everyone is treating this as a security event, when the lesson to learn here is one of business continuity. In an earlier piece, I talked about how we should interrogate our governance bodies to lead them to express assumptions and risk tolerances - to operate at the wisdom layer of governance. In response to this event, I would hope schools are asking questions like what are we structurally blind to? What does this say about our procurement model? What risk posture are we choosing?

Obviously, for the first, many institutions were blind to their total dependence on Canvas. Where else does that dependency lie? As to our procurement model, it is the persistence of these tools despite near universal hatred that needs questioning. In terms of our risk posture, are we trading resilience for the convenience of centralized “management”?

It’s simply too easy to tsk tsk at Instructure. While it may yet prove that they deserve some scorn, I would hope institutions use this to look at their own reflection in the mirror of this event. Outages don’t create failure - they reveal where the real system already exists. Institutions should recognize that risk posture is an emergent property of procurement and dependency choices seemingly unrelated to cybersecurity. We have co-authored the chaos we now are experiencing.

Subscribe now

My relationship with metrics has been persistent but strained - no doubt something I share with most security and privacy officers. Like a marriage, it begins in the brightness of activity, but with time it deepens, until the true weight settles below the surface. I suspect that almost everyone - not merely security professionals - at some point uses ‘activities we can count’ as a metric to demonstrate their contribution. Who hasn’t shown charts of attacks detected and blocked by an intrusion prevention system to their leadership? What help desk manager hasn’t counted tickets handled to demonstrate their workload and efficiency? Which privacy officer hasn’t shown a count of individuals put through privacy training as a proxy for impact?

At times these sorts of metrics serve a purpose. Showing your institutional leadership that your network experiences 100k attacks and probes an hour ratchets up their tension - a tension you’re there to reduce. Demonstrating that your help desk ticket growth is 2x per year helps make the case for better tooling or additional staff. But fundamentally these are mere measures of activity, none of which demonstrate a lowering of risk or an improvement in the quality of service (or customer satisfaction). We count these things because we can; we present those counts because we have them, and they demonstrate that we are busy. We revel in them because we are acting as managers, managers concerned with maximizing the use of the resources we’ve been competing for.

But these are not the sort of metrics that we should present to governance - they’re neither strategic nor useful for informing strategic decisions. The body of this post is to look at metrics as a Socratic tool for governance. We need to move from viewing governance as a passive approval queue or administrative checkpoint toward an active, inquiry-based method of strategic leadership. Thoughtfully developed metrics can assist in making this shift happen. By this I mean using probing questions to transform technical data into contextual intelligence that guides institutional risk decisions. Essentially, in most boardrooms, metrics are used to end a conversation; instead, I am going to argue that metrics should start a conversation: from “look, we're doing fine” to “the numbers look fine, but what is the story they aren't telling us?”

Subscribe now

I want to start by acknowledging that the space of cybersecurity metrics is multi-dimensional. This isn’t just an issue of bringing nuance to any discussion of metrics but rather it’s that metrics themselves serve different purposes in different dimensions. For example, one of the first questions a leader typically asks about cybersecurity is whether their investment - the security budget - is appropriate and adequate. However, in practice this is usually appended with “compared to our peers.” This is a classic form of reductionist framing whereby all of the distinguishing characteristics of an institution are reduced to “peer,” and on this the comparison rests. “But XXXX is a similar sized school and their security budget is only 80% of ours” hinting that we can do with less. I’ve heard this dozens of times, though no one ever points out the reverse.

Answering this properly requires examining the risk landscape, the risks mitigated and unaddressed, and working backwards to the investment required. But that’s a complicated exercise. I’ve long been a fan of going ultra-reductionist when performing quick and dirty institutional comparisons. These are simple measures both technical (e.g., security budget per active network IP address) and non-technical (e.g., security budget as a percentage of research expenditures) that can be counted consistently across institutions1.

A second dimension has to do with the oversight role of governance. Every governance body can appropriately ask “where are you in establishing the program you’ve described and that we’ve funded?” While this may not be truly strategic, it inevitably suggests that metrics on program completion have to be part of any metrics portfolio. The challenge here is to couple these metrics to outcomes and risk reduction. Of course, this means that as you build your proposed program, each element of it is justified, not as ‘best practice’, but is explicitly qualified as a form of risk reduction. They should be framed as mitigations for institutional risks that executives already prioritize. But even here we have an opportunity to begin training our governance committees.

If we limit ourselves to stating “we’re only 70% of the way done” - there’s little conversation to be had. Essentially even in the case of program completion your metrics should not just reflect outcomes, but expose the assumptions linking activity to outcome to risk. For example, instead of “% of program complete,” ask “what risk remains if this program is only 70% complete - and what assumptions are we making about the missing 30%?” I like this approach because in it is found some flexibility. Too often a program statement becomes a scorecard your auditors or management uses to box you in. By questioning and surfacing the assumptions underlying the unmet risk you may find the freedom to pivot your remaining resources to more effective efforts.

Share

This leads us to the third dimension I’d like to discuss: that “smart leadership expresses their ‘focus’ through asking questions.”2 In the context of working with a governing body, this could be as simple as interrogating incentives. For example, probing why certain risks are accepted, such as why an institution might sign a contract that caps a vendor’s liability far below potential breach costs. What you are hoping for is to start a conversation about risk - a conversation that creates traceable wisdom. Once metrics expose assumptions, someone must interrogate them, and that “someone” is governance, hence my focus on inquiry-based leadership. By traceable wisdom, I am referring to the ability of an organization to reconstruct the logic, context, and ethical reasoning behind a past decision, long after the original decision-makers have moved on. It’s the difference between seeing a firewall rule (the what) and understanding the specific threat or business trade-off that created it (the why).

In my earlier post on Radical Reciprocity, I introduced the notion of a “Socratic” pause, as a moment where in both engineering and policy development the organization can step back and ask questions about prioritizing proportionality, privacy, and long-term autonomy over expediency. This strikes me as necessary if we are to truly stop treating security and privacy as supplemental, but rather embed them into the organizational culture.

Increasingly, I am seeing organizational governance as nothing more than a kind of living policy process. One in which big-P policy decisions are made as a kind of “Just in Time” policy. This suggests that for this third dimension of metrics, we don’t need metrics that are answers (e.g., budget benchmarks or completion rates), but want metrics that are prompts (e.g., risk justification, residual exposure, and assumption testing). Essentially, each dimension of cybersecurity decision-making requires not just different metrics, but different kinds of questions those metrics are meant to provoke.

You may notice that I’ve used a little sleight-of-hand by redefining the term ‘metric’. What I’m doing is overloading the term, moving it from a measurement artifact to a decision instrument. In dimension one - let’s call it the survival layer - metrics are precisely what we’re used to thinking of them. They are counts of things, measurement artifacts, used as tools to satisfy the board’s hunger for benchmarks without losing your soul. For dimension two - the execution layer - we begin the redefinition. Here we pivot from a simple metric, in this example, percentage of program completion, to using it as a springboard for conversation on the implications, assumptions, and meaning of what’s unfinished. Thus a decision instrument.

In the third layer, what might be called the wisdom layer of inquiry based leadership, we transition the governing board from being a “passive approval queue” to a “living policy process.” With each layer, traceability becomes more important. Traceable wisdom strives for logic over legacy. It replaces “this is how we’ve always done it” with “this is the specific risk we identified in 2024 and why we chose this specific mitigation.” It creates contextual accountability by acknowledging that decisions are made with imperfect information. By documenting the context of a choice, you allow future leaders to improve upon it rather than just resenting a seemingly “bad” old rule. And critically, traceable wisdom forces the organization to take a longitudinal view of cybersecurity. Wisdom is “traceable” when the organization’s collective intelligence grows over time because its failures and successes are recorded in a way that provides a roadmap for successors.

By framing the wisdom layer this way, you are teaching the board that their job isn't to hold the CISO accountable for the numbers - it’s to hold themselves accountable for the reality those numbers reveal. Let’s try on a few examples. One of the most common metrics CISOs are asked about is the percentage of known unpatched vulnerabilities. I like this example because it works at multiple layers.

• Survival (managerial): Count of patches applied. (Are we working?)

• Execution (managerial moving to strategic): % of critical vulnerabilities addressed + explicit assumptions about exploitability and reachability. (Are we working on the right things?)

But if we want to operate at the wisdom level of governance, we need to pivot this question entirely: What classes of vulnerabilities persist and why? What does this say about our organizational, development, or procurement model?

Instead of asking how fast we can bail water, this layer asks why the boat is made of porous material. It forces the board to look at the “technical debt” of procuring cheap, unpatchable software. More appropriate for higher education, it begs the question of how our technical resources are organized as well as the cultural barriers that prevent patching. What this surfaces is that the wisdom-layer metrics force non-security decisions into scope. They expose that cybersecurity outcomes are often downstream of procurement tradeoffs, decentralization, funding models, and academic autonomy, all of which are the real roadblocks to an effective vulnerability management program3.

For a second example, let’s return to the question of a security budget. This question is arguably the most important because it addresses the financial soul of the institution. In the wisdom layer, you are moving away from “spending money” toward “investing in a worldview.”

• Survival (external benchmarking): “We spend 5% of IT on security, which is the peer average.” (The goal is to not look like an outlier).

• Execution (internal proportionality): “We spend $X per active IP or 0.5% of research expenditures.” (The goal is to prove the spend is mathematically tied to the attack surface).

Instead of looking at the total dollar amount, the wisdom layer looks at the asymmetry of the spend. In essence, we are asking “if our institutional mission is high-performance research, why is 90% of our security budget spent on administrative compliance and only 10% on protecting the research intellectual property that defines our reputation?”4 This forces the board to realize that “adequate funding” isn’t a single number; it’s a series of trade-offs. If they choose to under-invest in research security to save money, that is a traceable decision that defines their risk posture and gives you concrete guidance that shapes your program.

In practice, it can be challenging to take a committee or board that’s fixated on a specific use-case (EDR as too intrusive) or incident (PII exposure) to the question of proportionality. I’ve found it very productive to work with one or two members of a governance committee - typically faculty - to seed such a question for you. You, as the CISO or manager, know the answer to the question already: momentum and previous commitments. You sit in central IT and on most campuses it is an administrative engine. They enroll students and cut paychecks. Everything else is an elaboration. But your governance committees or boards must take a broader view of the institution. By operating at the wisdom layer, you force the institution to articulate its values and ensure that cybersecurity is treated as an embedded value in the institutional mission rather than a discrete, isolated IT function.

I began by talking about metrics - those classical things we can count. The problem was never that we lacked metrics. It’s that we used them to avoid judgment rather than demand it. Metrics are not measures of activity, nor even indicators of performance—they are instruments for making institutional values visible and accountable over time. An institution’s cybersecurity posture is simply the accumulated record of the risks it chose to accept - and whether it can explain them. If governance refuses to operate at the wisdom layer, then cybersecurity will remain a theater of activity metrics and deferred responsibility.

Subscribe now

In several posts1, I’ve discussed the role of norms in cybersecurity. I defined the term ‘norm’ as: “a shared expectation about appropriate behavior within a community, sustained not primarily through formal enforcement, but through mutual recognition, reputation, and the prospect of inclusion or exclusion.” The more I reflect on the concept of a norm, the more I find this a fascinating concept that can be used to explore both the practitioner and societal dimensions of cybersecurity practice.

Originally, I sat down to write about international norms, and to look for parallels between cybersecurity and norms surrounding traditional war, biological weapons, and arms control. But as a community - the community of readers of this blog - our ability to influence international norms is quite limited. Compounding this is the reality that cyberweapons (and I’m including both stuxnet and ransomware in this category) are already so widely used it’s not clear to me what sort of event might change that trajectory. A random piece of malware that inadvertently vents radioactive gas from a plant into a nearby town? A children’s hospital having all its power and hvac disabled by an attack meant for a military facility? So far cyber attacks lack the visceral impact of mustard gas in trenches. So I want to think about this a bit more. Instead, in this post I will tackle the notion of cybersecurity norms on a more familiar scale.

Subscribe now

If our ability to effect change on international norms is low (which, tbf, is probably an overestimate) then perhaps it is worth considering norms within our own sphere of influence. I believe there is immense value in codifying a body of norms, even if they lack a formal enforcement mechanism or any hard consequences for violating them. Most people think “if you can’t enforce it, it doesn’t matter.” I am arguing for the opposite: the act of codification is a performance of maturity. It is itself a form of institutional signaling: it clarifies expectations, creates a shared vocabulary for action, and makes deviations legible. Even without enforcement, norms shape behavior by making it observable and comparable. As I’ve stated many times, any time we act as a community on issues of extra-community significance, we demonstrate to the broader society that we have our act together. Sometimes even a gesture is recognized for its value and initiates a general conversation.

I suspect this is a topic that would benefit from examining a couple of use cases and extracting archetypes from them, rather than starting from abstract principles. So let’s start with an obvious one: ransomware in medical centers or hospitals. While I’ve been close enough to this to see that professional to professional communications do take place - despite our counsel’s reluctance - it’s very ad hoc. What and when you learn of any details about an incident depends on individual personalities, connections, and inclinations as well as the institutional fear of liability. Similarly, the prevalence of ransom payments is opaque, though widely believed to be high2. Given the immediate impact on patient care and thus actual patient survival, it’s easy to see how these institutions come to the conclusion that paying, no matter how distasteful, is prudent3.

What is it we would like this community (the academic medical center or hospital) to do in these situations? What should be normal behavior? My immediate list would be:

• Refusal to pay ransom

• Sharing attack information within the community as soon as possible, faster than is comfortable.

• Radical transparency (within bounds)
  Share actionable details quickly: TTPs, indicators of compromise, initial access vectors, and control failures. Redact only what would materially aid attackers or violate law. The norm is “useful over polished.”

• Minimum viable continuity for peers
  Share temporary mitigations peers can deploy immediately (e.g., block rules, config changes), even before your full fix is ready.

• Reciprocity
  If you benefit from others’ disclosures, you have an obligation to contribute back when it’s your turn. Make that explicit.

Share

Incident driven norms will probably converge regardless of the nature of the incident. So for a second example, let’s instead ask: how do we operate when nothing is on fire? Here I imagine we begin to describe many of the operational principles for an organization’s security team. For readability, I’m paring this down to a minimal operating set - a fuller listing of operating norms is in a footnote4.

• Norm of restraint
  Just because you can deploy a capability (especially AI-driven) doesn’t mean you should.

Now we translate principles into day-to-day engineering and operations.

• Usability is a security requirement
  Controls must be workable; persistent bypasses signal design failure.

I’ve been struck, when joining a new organization as CISO, how few management decisions are truly documented or codified. So we need to ensure decisions are rational, traceable, and improvable.

• Institutional memory
  Preserve decisions, exceptions, and lessons so they survive turnover.

No set of norms would be complete without addressing risk and its relationship to governance. Risk must be visible, owned, and fairly distributed.

• No silent risk transfer
  Risks pushed to others must be explicit and accepted: this must include users.

Finally, and critically for this discussion, we should extend norms beyond the organization.

• Ethical use of security capabilities
  Apply proportionality and respect for privacy, autonomy, and context.

• Responsible disclosure as a civic duty
  Enable and participate in coordinated vulnerability disclosure.

• Reciprocity and community contribution
  Share insights and artifacts; treat security as a collective defense problem.

At this point, let’s see if we can identify a modest number of core principles, i.e., operating norms, that combine the two examples above. After spending far too much time building tables and taxonomies in a spreadsheet, I’ve identified five.

If we merge the notions of sharing information, reciprocity, and community contribution, we identify collective defense as a norm. Let’s call it the norm of radical reciprocity. It establishes that if you consume the community’s safety, you are obligated to produce it. The standard is “useful over polished.” It implies that security is not a competitive advantage, but a shared necessity.

Similarly, if we combine the idea of minimum viable continuity and sharing temporary mitigations, we shift the focus from “we are safe” to “we are helping you be safe,” even before the incident is contained. It is the rejection of the silo mentality during an incident. This strikes me as a kind of operational empathy, which I’ll call the norm of active continuity. Fundamentally, your defense should be designed to help your peers survive, not just you.

I think a key overlooked element is the human-centric dimension of security. If a control is unusable or invisible, it is a failure, not a feature5. Here I’m trying to combine usability as a requirement and no silent risk transfer. Sticking with my naming convention, I’ll call this the norm of design integrity. It demands that security decisions be explicit and workable for the human beings at the end of the wire. It forbids the transfer of risk to users or peers without their informed consent.

I think one of the more difficult dimensions to capture is what I’m going to call the norm of capability restraint. I’m trying to find a space to acknowledge the existence of a kind of ethical friction in the deployment and use of technology. Just because a tool exists doesn’t mean it should be used. I think this synthesizes the concept of restraint and the ethical use of capabilities. It introduces the “Socratic” pause into engineering - prioritizing proportionality, privacy, and long-term autonomy over the “Turing test parlor tricks” of immediate efficiency.

Finally, I want to combine the idea of institutional memory with rational/traceable decisions. This gives us a norm of governance. It ensures that the "why" behind a security posture survives the turnover of the people who built it. It treats cybersecurity as a longitudinal practice, not a series of disconnected reactions. Perhaps the norm of institutional accountability - though I’m not fully comfortable with the term ‘accountability’, which carries too much baggage of ‘who to blame’6. But ultimately, a decision that isn’t documented didn’t happen.

These aren’t controls; they’re commitments. And commitments, unlike controls, are visible to others.

Assembling these into an inter-institutional agreement would be challenging. Even as I write this, I can imagine other ways to frame cybersecurity norms. The five norms reflect my own experience - less as a technical problem than as one of communication and organizational politics within a shared community. In that sense, defining cybersecurity norms becomes a kind of civic problem, shaped by the same social and psychological forces that govern any community.

Any norm in a higher education cybersecurity compact would require careful interpretation, with examples to clarify and guide its application and interpretation. Institutional counsel and insurers would inevitably weigh in - and while that may seem daunting, it is a sign that the norms are being taken seriously. The difficulty of formalizing them is not a weakness; it’s evidence that they matter.

Subscribe now

One of the enduring tensions in higher education has to do with its role. Is education about transmitting knowledge or is it about teaching how to engage in critical thought? The public sees this as a non-issue: higher ed is where you learn stuff and get a degree, a certificate entitling you to a job. But for those of us enmeshed in the mission, it’s not so clear-cut. For many of us, the noble goals of higher education are the calling.

Of course this is a false dichotomy; both learning and critical thought are elements of what any college or university is trying to achieve1. While schools do deliberately try to teach logic, analysis, and critical thinking skills, in practice this is often left to the student to be gleaned from examples. We study the development (and mechanics) of an idea and hopefully learn about how an advancement was conceived, approached, and ultimately resolved. Whether we are studying a piece of music or special relativity, the underlying ways of thinking are often more implicit than explicit in our education.

I began to think about this in light of the public discourse on AI. I’m struck by the framing of AI as a replacement for human activity rather than as a tool to enhance human thought. I suppose this isn’t surprising given the current historical moment of late-stage capitalism and that modern AI is predominantly an artifact of the massive tech firms. Yet it is an unimaginably expensive product without any clear function or ROI; as such it requires a messianic sales pitch to attract investors. And if there’s one element of production that seems intractable to optimization, it’s people - and thus they become the target. But to replace people requires the devaluation of thinking. Which is so neatly tied into that sales pitch: it promises to automate the result (knowledge/output) while ignoring the process (thinking). As I’ve argued before, this only continues to erode respect for thought work - perhaps even pathologizing it as costly and unnecessary.

Subscribe now

Imagine if AI were treated less as ‘something to be trained to replace our activities’ and more as ‘something to synergistically enhance our thinking’? That is, AI as a tool for augmenting critical thinking rather than replacing cognition. Is this even possible? How can an AI agent support and enhance our own critical thinking, without simply offering up alternative narratives or prose?

Thus my opening about the role of higher education: is it primarily about transmitting knowledge, or about teaching students how to think? My position on this surely reflects my own point in life - I’m not in school trying to learn enough to launch a career. So I view this question from a position of privilege. And clearly you want your accountant / doctor / historian / engineer to actually know things. Knowledge is important. Be that as it may, my own experience - especially in graduate school - was not primarily about absorbing knowledge for a career. I studied music history yet ended up working in tech. No factoid from music history has ever come into play as a cybersecurity practitioner. While the factoids were useless, the disciplines of music history (e.g., pattern recognition, writing, analyzing structural tension, understanding historical context) are exactly what you use in cybersecurity, particularly in leadership roles.

What would an AI agent that supports critical thinking look like? I’ve no doubt I’ll soon hear from colleagues who work in pedagogy who will tell me this is well-worn turf and a subject of frequent discussion. Clearly the public discourse surrounding the use of AI has been co-opted by those attempting to market AI en masse, for whom replacing people seems the fast track to profits. To be fair, the parlor trick of an AI that easily passes the Turing test is seductive. But is this truly the best we can do?

Should we tailor our AIs into mentors? Creatures that can intellectually joust with us, pushing us into new and fertile areas of inquiry? Or are they best used as discovery engines? Surely part of learning to think critically involves the logistics or mechanics of learning. I recall the keen excitement of walking the graduate stacks in school, after finding the target of my search, browsing the books on either side of it, or across the aisle - the power of serendipity gently shaped by the LCC system’s ontology of knowledge2. Perhaps with its ability to rely on fully scanned text and not merely metadata, an AI’s ability to point to connected sources thematically creates a richer web of guided serendipitous discovery. I can imagine that these would be powerful, and I expect that both are being explored academically and commercially.

I recall, as an undergraduate, attending the physics tutoring sessions. I was struck, while waiting my turn, listening to how the tutor coached a student on solving a particular problem. The approach wasn’t to simply state the solution; rather it was to ask the student questions that lead to the student asking questions of the problem. The critical thinking lesson was to learn how to interrogate and reshape the problem itself such that the solution simply fell into place. This is not unlike how many advanced math and physics domains are advanced today. An unsolvable theorem is shown to be identical to an apparently unrelated one, using entirely different mathematical techniques and formulations that is understood and solvable. In physics, difficult problems are rarely solved head-on. They are reframed - through symmetry, analogy, or a change of perspective - until they become instances of something already understood.

An AI mentor could easily provide this sort of coaching, at least for more elementary problems. But could that coaching be extended into less understood or more exploratory domains? How would you need to train an AI to ask Einstein “what would it look like if you rode a beam of light toward a clock?3” This is question driven thinking that forces a reframing of reality. In a nutshell, it captures Einstein’s genius. I seem to be leaning into the idea of an AI being a Socratic gadfly. Which is fun since so much of the discourse in higher ed around AI is stuck in the academic integrity space.

Share

The issue would seem to revolve around the question of how one can learn critical thinking. In my own experience, there seem to be two dimensions to this. First, the kind of guided training I described by watching a good physics tutor at work. We also experience this through textual analysis. Reading sophisticated literature and being guided through the analysis and understanding of it also reinforces critical thinking pathways. I suspect most of us have experienced this. But second, and something I don’t fully understand, is why knowledge acquired at one point often only becomes meaningful later - when experience supplies the context required to transform recognition into understanding. In other words, understanding is often delayed until experience makes prior knowledge meaningful.

While I can imagine an AI tutor succeeding at the first dimension, the second seems to be an entirely different beast. I suspect it requires the AI tutor to have some sort of mental model of the learner - and quite a rich one - before it could tactically influence the learner’s thinking. The real value of AI in education is not as a generator of answers, but as a scaffold for developing critical thinking - and current implementations largely miss this. AI can guide reasoning in the moment, but cannot yet participate in the longitudinal development required for true understanding. The next frontier is AI that models the learner, not just the problem.

I’ve wandered into the weeds, so let's return to the path. It’s troubling to see institution after institution view ‘the challenge of AI’ as either academic integrity or a security and privacy challenge. Thus the race to stand up locally managed LLMs, which are merely localized versions of the giant tech LLMs. This isn’t unreasonable, for it allows their use within institutional workflows while minimizing the exfiltration of protected data.

My suspicion is that most institutions of higher education find themselves in a corner. Along one wall is the challenging, scarcely understood, and purely aspirational wall of using AI as a platform to enhance critical thought. The other wall, the demonstration wall, is the absurd pressure institutional leaders are under to demonstrate relevance and currency. The cautious and wise leader is rarely the loudest one in the room, and reward flocks like cicadas to noise. Meanwhile, the floor trembles endlessly to the footsteps of the commercial marketplace with the boundless promises of AGI and with it threatens the collapse of the world order. To ignore the demonstration wall is a mark of failure while the aspirational wall requires creativity and patience. Only marching in time to the vibrations of the floor seems prudent.

But I would hope universities and colleges would recognize that how AI is framed in most discourse - corporate and academic - reduces humans and their actual thought work to training content creators busy training their own replacements. I would hope to see institutions invest in AI as cognitive scaffolding, e.g., question-driven systems, reflective prompting, or longitudinal learner models. The proper success metric is not a count of workflows that use AI, or speed of service ticket handling, contracts analyzed, or any of the other facile and unimaginative efficiency gains. But rather the more challenging measures of improved reasoning capacity and intellectual maturity.

Returning to the original tension: education as transmission vs. transformation. It does seem to me that AI can play a truly pivotal role in that it will amplify whichever side institutions choose - either mechanizing knowledge delivery or deepening critical thought. So perhaps the best way to end is with another question: What kind of thinkers do we want to produce - and what tools are we willing to build to get there?

Subscribe now

Like every other human who reads, I’ve been inundated by headlines about Anthropic’s ‘new’ Mythos product. If ever anyone doubted that we are still in the golden age of cybersecurity awareness, they should hang their heads in shame1. Cybersecurity - in one form or another - has been an above-the-fold topic for years now in almost every daily news feed. Supercharged by its alloying with AI, it has become an irresistible story.

Whether the attention is warranted or simply a product of media fixation, the claims of Anthropic are worth considering - not because Mythos is (or may be) (or is surely not) the inflection point it is being made out to be - but because of what it can tell us about the evolutionary arc of the field. As a backdrop, I tried to summarize my own view of how the field has matured (or at least changed) over my career - and then asked ChatGPT to format it into a table for me2.

As an aside, I found creating this a useful exercise. It forced me to confront how often my unconscious thinking fell back to the traditional emphasis column, pushing me to reframe my thinking to align with the emerging approach column.

Subscribe now

So where does the ironically named Mythos fit into this historical perspective? And what impact is the publicity having? Regardless of its practical impact on cybersecurity, is the attention it’s drawing to product vulnerabilities a net positive or negative?

There is a consistent flavor to the coverage of Mythos. At a very low-cost, Mythos was able to uncover a number of vulnerabilities, some quite old, in a variety of products. Of course, many AI tools do this - and many of those models are far cheaper than Mythos. The professional coverage3 is a bit more balanced than the popular press, calling out that patching software remains a far more elusive goal than identifying vulnerabilities. It does you no good to have clean drinking water if your pipes are made of lead.

Of course, Anthropic’s own pronouncements on the strength of Mythos are of the same ilk as Musk’s plans for going to Mars. “We hope this will show why we view this as a watershed moment for security, and why we have chosen to begin a coordinated effort to reinforce the world’s cyber defenses.4” It’s not a code scanner, but a watershed event with a global impact. Sigh. I should have named this blog the Newer New Testament5 but apparently I lack the bullshit gene.

Naturally the first thought many of us had upon reading about Mythos wasn’t “boy, this is going to solve our problems!” but rather, “oh boy, this is going to create a lot of problems!” Why? Because the same technology that can identify weaknesses we need to shore up can be used to identify weaknesses adversaries will target. Yes, the glass half-empty mindset still comes naturally to many of us. Yet, to be honest, while I’d welcome advances in code scanning that improve code quality, I’m actually rather ambivalent about it. We know from experience that 1. many well-documented vulnerabilities simply don’t have patches available; and 2. many if not most organizations have poor patching practices.

As I’ve talked about elsewhere, the former simply won’t be addressed until the entire incentive structure of product development is changed, including legal consequences for the sale of flawed products. The latter is, however, a different kind of beast. With over 30,000 vulnerabilities uncovered every year, it’s frankly unrealistic to expect an organization to devote the time and absorb the disruptions that would occur if they truly tried to patch everything - especially in a timely fashion. Even if we restrict ourselves to ‘critical’ vulnerabilities, the problem isn’t that simple. Every organization needs to place even a critical and easily exploitable vulnerability into their local context. Do you even use the vulnerable software? Is it exposed in a manner where it could be exploited? Are other compensating controls in place that lower the risk or the impact?

There’s simply no way for a code scanner like Mythos to know these things. I’ve no doubt that the entire market space of dynamically contextualizing vulnerabilities6 will benefit from some of the advanced capabilities of machine learning. But that statement has always been true.

Share

We should also ask how the Mythos coverage reinforces or establishes perceptions about cybersecurity. It may be necessary to burnish each tool in the cyber toolkit, but resilience in an organization isn’t a consequence of any specific tool or process. It’s the coordinated operation of these elements that allows an organization to thrive despite the cyber onslaught. Focusing on Mythos as a paradigm shift could be helpful if, for example, it draws attention to the weakness of the broader software supply chain. However, I fear it is more likely that the coverage reinforces a fragmentary view of cybersecurity and cyber tools.

With this, we finally get an answer to the question I raised above about where Mythos fits into this historical perspective. It’s difficult to sell a lifestyle; it’s easy to sell a supplement. It’s even more difficult to adopt a lifestyle than swallow a supplement. Mythos may be terrific or it may be underwhelming - but regardless of where it falls on that spectrum it is merely another iteration of a point solution in a universe of points.

It’s worth asking what it might mean if Mythos were perfect; a magic tricorder able to scan software and uncover every possible vulnerability. A perfect tool owned entirely by one vendor, who would suddenly be able to hold the global economy hostage; a vendor able to intimidate hostile governments by offering its findings to only friendly ones. A true monopoly of cyber knowledge. What would we all pay for this?

I’m reminded that most of the medications I take are generic versions of successful commercial products. Medications are protected by a patent for a period of 20 years. Since drug development and approval typically takes 7-8 years, this grants companies around 12 years of exclusivity - though there are a number of nuances to how and when exclusivity is applied. Why is this done? Why aren’t the inventors / discoverers granted permanent IP protections? There are several reasons. By allowing for a period of exclusive profit companies are able to not just recoup development costs, but generate a profit, thus, in theory, incentivizing future research. But importantly, by transitioning drugs to generic formulations, society as a whole benefits both from large scale manufacturing and wide availability. Globally, millions of lives benefit from this wrinkle in the regulatory fabric.

If we were faced with a perfect Mythos product, is it ethical to allow it to be solely controlled by one company? Should there be an equivalent process to the one for drugs to transition to generic for powerful cybersecurity tools? We cyber practitioners love to point out the fundamental role cybersecurity has in our modern, digitally mediated society. No longer are we focused solely on PII, but now the battle space is one of national infrastructure: the operation of water, power, and economic facilities. Isn’t our health equally dependent on digital resilience as it is on the availability of generic medications? This feels like a more difficult thread to explain to the public and regulators, but surely one we need to tackle.

I can’t entirely blame the popular press for how they cover Mythos. The issue may be software security, but the story is the product. We see this same pattern in almost every headline - the issue may be corruption in general, but the story is the individual being bribed. Nor is it surprising that Anthropic engages in near messianic language in their press about Mythos - they are, after all, creating a marketing myth. But we should take this as an opportunity to revisit how we frame cybersecurity when we do talk to the press, and we should engage our legislators in conversations about how the regulatory landscape for cybersecurity needs a remodeling. If I were to add a row to the table above labeled “Regulatory Approach”, I fear it would still be focused on consumers instead of producers and under the heading of “Emerging Approach” simply say “more of the same.”

Subscribe now

I was struck by a comment a colleague made the other day that part of what troubles cybersecurity is “vendor sprawl”. It must have been kismet, for I had just spent a couple of hours falling down a rabbit hole, researching the market for IP address reputation services1. This post is the resulting confluence of these two moments. As I reflect on the question of vendor sprawl, I think this is less a problem of too many vendors and more a problem of how the cybersecurity marketplace itself is structured.

Of course, the wise question to ask - if you’re in the market for one of these commercial services - is why. Why devote time and resources to a specific security control over any of the others in similarly rich markets? But this is just one expression of what I take to be meant by vendor sprawl: that for nearly every element of your environment, there exists a corresponding marketplace. Tools to analyze and optimize firewall rules? Check. Real-time vulnerability scanning? Check. Endpoint protection, DDoS mitigation, phishing detection, deception networks, certificate testing, code analysis—each with its own ecosystem of vendors.

It’s incredibly seductive. You hit the vendor floor at a conference and every single vendor makes a compelling case for why their flavor of whatever they’re selling will improve your security posture tenfold. And maybe it will - too often constraints in staffing and budgets mean that your homegrown alternative is just enough to be effective. In consultant speak, crawling is sufficient, walking or running is aspirational. Surely (says the addiction) we could optimize this by investing in some professional tool. Perhaps running isn’t aspirational, it merely requires writing a larger check.

Of course, your staff are not idiots. When they Macgyver a solution they’re usually doing so in a fashion so it’s manageable in what limited time they have available. They’re automation engines. When you buy a tool, it inevitably requires more staff time. Ignoring configuration and deployment, you’ll need to integrate its outputs and detections with your other tools, and often there’s a UX that’s designed, god help us, to have eyeballs on it, rather than to deeply integrate with your logging and analysis tools. Call it the integration tax, which leads to integration fatigue. Those lovely screens showing attacks, or blocks, or attack analysis - the same screens that issued that siren call across the vendor floor and gave you a come-hither stare, are actually impediments to getting work done. The context switching burden alone acts like a 3% tax on your staff’s time2. It’s worth remembering this as you drool over these tools. As a CISO, you may view them in terms of how they fit into your mitigation portfolio. But how they fit into the capacity and workflow of your team is probably a wiser perspective. Strategy vs. management in a nutshell.

Subscribe now

Essentially what might be called ‘vendor sprawl’ I see as the market-driven decomposition of security: an infinite number of addressable niches and the fragmentation of controls. I suspect there is a divide here between commercial organizations and higher ed. More of these niche solutions are adopted in environments where the coupling between investment and risk reduction is more explicit, if not driven by compliance. In higher education we’ve valorized macgyvering to the point of wearing it like a badge of honor.

Perhaps this is worth unpacking. We can ask what drives a market, and in the case of cybersecurity, is that driving it into a shape apposite to the operating style of higher education? To my eyes, and this has been consistent over my entire career, the vendor market has been shaped by the deeper pockets of the commercial sector. Our attempts to influence it (through programs like Internet2 Netplus or those vendor higher ed advisory committees) rarely influence product in any meaningful degree, but are focused on contractual and pricing terms. “We want what they’re having, but cheaper since we’re non-profits” seems to be our strategy for vendors. I suspect there’s an opportunity for us to have a conversation about what it is we truly need from the market. Is it more bundled solutions? More platforms and fewer point solutions? Are there specific practice spaces (such as backups or MFA) that need to expand as an alternative to the continued proliferation of niche solutions? I don’t see that we, as a community, have addressed the question - but rather we fall back on the ossified practice of holding our hats in hand and asking for a few crumbs.

But I do think it’s worth pausing for a second and noting that all of this vendor sprawl isn’t accidental. It’s structural: a feature of our economy where any notion of planning has been replaced by an embrace of the free market, for better or worse3. For those building their operational portfolio, the upside is largely positive. For every risk you decide to address, the market offers you a host of options. In the best of cases the vendor is providing an analytical depth for the challenge that you and your team probably don’t have the capacity to reach on your own.

But it’s difficult to get away from the resource demand these solutions create, and the integration fatigue they introduce as you attempt to adopt them into your tool ecosystem. Worse, they become a sunk cost that few of us are willing to abandon easily, not to mention the cost of changing solutions as the market shifts and new approaches eclipse older ones. Vendor sprawl can cynically be viewed as a system for creating technical debt across the cyber ecosystem. I think it’s more helpful, however, to see this as a critique of cybersecurity as a market-assembled system that cannot keep up with its own fragmentation. Woe to the organization that, with the best of intentions, plows ahead naïvely trusting that system.

Share

You should be able to tell that I’m trying to have it both ways. As an inveterate noodler, I like and am attracted to these niche solutions. There’s a veneer of corporate professionalism to many of them that our homegrown solutions appear to lack - though admittedly that lack is often presentational rather than substantive. On the other hand, embracing the vended market runs the risk of using successful marketing as a proxy for the thought work necessary for risk assessment and subsequent strategy development.

I see three primary consequences to the arguments I’ve been making. It may be that we need to re-architect security to use fewer, more integrated systems. I don’t have hard data on this, but my observations of the field suggest many of us are embracing this, what I’ll call the ‘design argument’ as an approach to managing vendor sprawl. Second, could it be as simple as needing stricter prioritization and a refusal to buy additional tools that aren’t at the top of the prioritization list? Given the historical underfunding of cybersecurity, this ‘operational discipline argument’ may already be widely practiced.

However, design and discipline are partial responses. More importantly, as I’ve discussed above, the challenge of vendor sprawl is inherent to the system; we manage, not solve it. There’s probably an interesting conversation to have about this from the institutional-scale perspective. Given the real costs of vendor solutions - and thus the ‘tax’ of vendor sprawl - there is a security poverty line, i.e., a minimal investment burden necessary for an organization to maintain viable security. What are organizations to do when they fall below that poverty line, lacking the funding to spend above it, and the resources to develop below it?

I can see two possible areas for action. First, we need to begin to press for a more strategic form of regulation. Most conversations around cybersecurity regulations focus on controls - which ones you need to implement. This really isn’t surprising since it has a long history and thus a lot of momentum, and the primary work coming from NIST has been control oriented. It’s useful, however, to consider the nature of influence a regulator can have in a market economy. By creating regulations around specific practices, the market will - at least to some degree - coalesce around those practices. For example, if the Feds expanded the mandatory use of phishing-resistant MFA from Federal systems to all commercial services, that would require the MFA vendors to double down on support for phishing-resistant tools. Further, the sheer scale of market demand would induce new vendors to enter that space. This is to say, we need market steering regulations as much as we need them for corporate practice.

Second, it’s worth revisiting the notion of market norms. A norm is a shared expectation about appropriate behavior within a community, sustained not primarily through formal enforcement, but through mutual recognition, reputation, and the prospect of inclusion or exclusion. Norms sit between law and preference: they are not codified like regulation, but they are stronger than individual choice because they are collectively reinforced.

In a market context, norms function as informal governance mechanisms4. Ideally, they shape what “good behavior” looks like beyond contractual minimums. Further, norms can reduce transaction costs by establishing baseline expectations and ultimately create reputational consequences for deviation (even when contracts are technically satisfied). Norms are generally unwritten rules that determine what vendors can get away with versus what would cost them trust, access, or legitimacy.

We as a community lack these norms. While someone who regularly works with vendor agreements can see how norms have become more emergent over the last 15 years or so, they remain focused on procurement terms. The conversation I’d suggest we engage in is around those market shaping norms that influence how and what solutions are presented to higher ed. If vendor sprawl is a structural feature of the market, then norms are one of the few levers we have to shape what that market produces. If sprawl is inevitable, norms can determine whether the market produces fragmentation or composable coherence.

I feel obligated to provide some examples of market shaping norms, no doubt someone with an economics background will comment on how weak these are, but here we go.

• Solutions that require standalone human attention surfaces (i.e., new dashboards) are viewed as incomplete or immature.

• A tool that cannot demonstrate deep, low-friction integration into a heterogeneous environment is not considered viable—regardless of analytic sophistication.

• A solution must demonstrate that it reduces total system complexity, not just adds capability.

• Marginal improvements in a narrow domain are not valued unless they contribute to broader system coherence.

• Solutions must explicitly account for human operational capacity as a first-class constraint.

• Products must assume decentralized governance and partial adoption—not idealized, centralized control.

• Tools that optimize existing controls (rather than reduce or consolidate them) are treated with suspicion unless they demonstrably eliminate other dependencies.

I think this is a reasonable starting point for discussion. The kind of norms I’m discussing must operate at the level of product legitimacy, not vendor etiquette. Ideally a strong norm will invalidate entire categories of tools or force redesign of existing ones.

Vendor sprawl, then, is not a failure of discipline or a temporary excess of choice. It is the natural output of a market that decomposes security into ever more granular problems and sells their solutions back to us. The question is not whether to participate in that market - we already do - but on what terms.

If we treat each tool as an isolated improvement, we inherit fragmentation and the operational drag that comes with it. If, instead, we begin to assert expectations - through regulation, through norms, and through our own purchasing behavior - we may be able to shape a market that produces coherence rather than entropy. The difference is not in how many tools we buy, but in whether the system they form is one we can actually operate.

Subscribe now

The Bulletin of the Atomic Scientists (BoAS) published an interesting piece the other day, “What can biosecurity learn from cybersecurity? A lot.” Part of why it struck me is that I’ve always thought about this from the opposite direction. Having spent a fair amount of time on a campus biosafety committee, I’ve been struck by the lessons we could learn from how biosafety is managed in a large environment as we try to figure out how to scale up our own support for research. With multiple labs, specialized equipment and HVAC requirements - not to mention, you know, Ebola - it seems like our own support and compliance models could borrow a lot from it.

I really can’t recommend strongly enough that if your organization deals with biosafety issues1, you reach out to the good people overseeing it and ask to participate. If nothing else you can point out that a successful cyberattack could result in those overpressure blowers failing, allowing disease-carrying mosquitoes to escape. You’ll find they have rigorous (and audited) protocols for everything from incident reporting and handling, to training and standards compliance, all issues you’re probably facing in your cyber domain2.

As I read through the BoAS piece, it surfaces several non-obvious lessons for cybersecurity—particularly as it matures into a domain with societal, not just technical, consequences. Viewed through the lens of institutional practice, several of the article’s arguments take on a different emphasis.

Subscribe now

First, norms have both power and limits. It’s striking how a web of treaties, arms control, and international agreements surround the world of bioweapons. Of course, none of these were established until after these weapons were put into place. Cybersecurity, on the other hand, seems unable to establish equally durable norms around state behavior and acceptable use.

The lesson here is that norm-building matters, despite the imperfect and difficult nature of enforcement. The shared expectations that become established, such as “don’t target hospitals” do shape behavior and beliefs. Yet for us in cybersecurity there seems to be little or no equivalent to the bioweapons paradigm (or kinetic weapons for that matter). The article’s implication here is that biosecurity demonstrates that norms built for discrete visible threats can become misaligned when risk is diffuse and systemic; surely this is a line we walk regularly as cyber practitioners. Nevertheless, I find this framing valuable to reflect upon.

For me, the implication is that cyber should be investing in international norms, but design them for continuous, ambiguous activity, not just “red line” events.

Second, as the BoAS piece points out, biosecurity remains heavily anchored to the weapons paradigm (which it says is inherited from nuclear strategy). Cybersecurity has largely (though not entirely) moved past this. Instead, as the article argues, we focus on the dimensions of capabilities, access, vulnerabilities, and effects, which are many of the core dimensions of the classic TARA (Threat Agent Risk Analysis) model. If there’s a takeaway here, it’s that we need to preserve this capabilities-based approach, and resist drifting into rigid categories (e.g., “nation-state vs criminal”) which can become limiting. That is we should maintain a capabilities-and-effects lens, and resist re-simplifying threats into overly discrete categories as our field matures.

Third, I was particularly interested in the discussion of how to tier risks. Biosecurity tends to oscillate between catastrophic scenarios (i.e., bioweapons) and benign research. Consequently, the article highlights intermediate risks, such as lab accidents, misuse of common tools, and the erosion of norms. This struck me because we cybersecurity practitioners have developed a more mature understanding of this spectrum. For example, the progression from commodity ransomware to advanced persistent threat to cyber-physical attacks.

Nevertheless, I wonder if we’re still underestimating systemic, low-grade risk accumulation, such as chronic misconfiguration, supply chain fragility, and the erosion of norms (e.g., the normalization of ransomware payments). Obviously we do worry about these things, but we should ask how we might approach this class of risk cohesively. Perhaps we should create or further formalize “middle-layer risk governance”. A space that is not just high-end adversaries, nor simple hygiene, but the accumulation of small, plausible failures with large aggregate impact.

The piece also draws attention to the notion of what it calls “distributed capability” which should be recognizable to all cybersecurity practitioners. Both biosecurity and cybersecurity share a few consistent features. Not only is capability widely distributed, but barriers to entry are lower than in traditional military domains, and small groups can have disproportionate impact. While biosecurity is now aggressively dealing with these, cybersecurity has long confronted them. Yet we too often act as if central authority is sufficient and that perimeters are meaningful.

I’m struck by how the implications here for cybersecurity may actually be more mature in the research security space. Clearly we must continue shifting toward federated security models, shared responsibility architectures, and in particular ensure that security is embedded in ecosystems, not merely enforced from the center. This strikes me as particularly true in a world where we need to treat persistent compromise as a baseline condition, not an exception.

Share

It follows from the observation on research security that infrastructure interdependence is the real risk surface. That statement seems to encapsulate so much of our struggle within our university environments where everything is interconnected at the bits, wires, and services level, yet independent and entrepreneurial at the decision-making and governance level.

The article’s most forward-looking point is the convergence of digital and biological systems. It points out that health systems depend on digital infrastructure, biological research depends on software, data, and supply chains and consequently failures cascade across domains3. Thus it is important for us to think in terms of societal infrastructure, not IT systems. Something that can be challenging to focus on amidst the chaos of ordinary operations and planning.

Thus, it seems that a mature cybersecurity strategy should step back and try to map dependencies beyond IT, extending those traces to include, for example, health infrastructure, supply chains, and research ecosystems. This sort of mapping immediately should lead us to map cross-domain cascading failures, and to factor these into broader resilience planning at the institutional or societal level.

It’s this question of how and who steps back that’s particularly challenging. One could distill almost the entire article into the observation that governance must match the system, not the threat. While biosecurity seems to be trying to move in this direction, it’s confronting a core misalignment, historically its governance was built for discrete threats, while reality is now defined by continuous, distributed risk. It feels to me like cyber may be further along this path. We’ve spent decades evolving governance to match its environment, through continuous monitoring, iterative risk management, and adaptive controls. But we also run the risk of allowing cyber governance to ossify. There is certainly a strong stream pushing us toward compliance-driven models, static frameworks, and checkbox risk management in our space. Cybersecurity governance must be designed to be adaptive (dynamic, not static), fully integrated into decision-making (not parallel to it), and capable of handling gray-zone activity, not just incidents.

Cybersecurity’s biggest takeaway from biosecurity is not technical - it’s strategic self-awareness. What the article seems to say is that biosecurity shows what happens when a field is anchored to outdated paradigms, relies on governance that lags behind technological reality (hello AI!), and that norms are strong but too narrowly scoped.

Cybersecurity, by contrast, has developed more adaptive approaches to persistent risk, intrinsic ambiguity, and distributed capabilities. But we are not immune from this same drift. Fundamentally, the challenge for us is not just managing threats - it is continually updating the frame through which threats are understood. Building on the BoAS article, one can say that if cybersecurity fails to do that, it risks becoming what biosecurity is now struggling to evolve beyond: a system optimized for a world that no longer exists.

Subscribe now

So your CIO and counsel come to you with information no one wants to hear. A significant data breach has been discovered, and due to state law, it’s a notifiable event. That is to say, whether notification to affected individuals is the right thing to do or not, it’s out of your hands and you’re required to issue notices. OK, you trust your people, and notification is the right approach, but what do you do in response?

It’s important to note that I’m not talking about the incident response. Let’s assume your team has that under control - they know what to do to contain, analyze, and handle the incident from discovery to the inevitable offer of identity monitoring services from the credit bureaus. That’s a given.

But the question I’ll focus on is: what do you do? As the organizational head, whose actions define the its response, what should you do beyond allowing your team to unspool their processes? You’ve probably already started part of this conversation: what resources or investment do you need to prevent this from happening again? That is, what is the role of executive judgment once legal, technical, and contractual processes have taken over?

Subscribe now

There are a couple of givens that you might not have considered. First, your team isn’t actually handling the incident. At every major institution (I am speaking primarily to major universities) an outside firm has been brought in, and with it, an attorney who’s actually running the show. Their goal, bluntly, isn’t to “do the right thing” or “support the affected community”; rather, their goal - the reason you’ve hired them - is to minimize institutional liability. That’s not necessarily a bad thing, it simply is how these things are handled today. Liability minimization is a governing incentive, not a moral failure.

Secondly, as with any major incident, you are rapidly approaching a point where your team will make that request for resources. They’ll offer up any number of initiatives, process improvements, or policy recommendations in response to the specifics of the incident at hand. What you may not realize is that this is precisely the critical juncture that offers you an opportunity for differentiation. Do you allow that ask to arrive as a proffered bundle of tactical responses to a situation, or do you pivot to the strategic? This is the inflection point that separates leadership from management.

This is challenging; in many domains, and certainly for cybersecurity, we tend to view incidents as a “crisis of technology.” However, by allowing the response to be handled by outside counsel and relying solely on an established incident response playbook, organizational leadership is suffering from a “crisis of agency”. This is our true issue. The machinery of honed practice often displaces the agency required for strategic leadership. The position I’m arguing for here is not to eliminate that machinery, but to recognize that it is a category error to see it - and the tactical requests it makes - as strategy. Operational response does not equal strategic direction.

In general, I’d like to see an organization respond by moving from incident-specific controls and towards improving their systemic risk posture. Too often I’ve seen the response to incidents instinctively lean into compliance thresholds and not true resilience objectives. At one of my last positions, a primary metrics identified in response to a number of high-profile breaches was to insist on 100% compliance with security training mandates. Your house is on fire, the firefighters have no water, but you’re being yelled at for forgetting how to perform the fireman’s carry.

I and others have made the case that breaches are inevitable, that they’re the cost of doing business. This is true, and worth remembering if you think they can be eliminated. But true institutional resilience isn’t going to “prevent this from happening again”; it will instead minimize its impact and more importantly, your goal should be to reduce the class of failures. As a leader, your responsibilities should focus on interrogating the incentives, not just the controls.

When I think about interrogating incentives, three dimensions come to mind. First, vendor risk allocation. This is how risk is distributed, priced, and enforced between your institution and the third parties you depend on - primarily through contracts, procurement standards, and ongoing governance. Right now, most organizations think they’re managing vendor risk, but in practice they’re often absorbing it. Organizations generally rely on outsourcing critical services. Those services are governed by contracts where cybersecurity is addressed through broad and often non-binding terms1. Any liability identified in contracts is typically capped, and often at amounts far below the actual potential costs. Ultimately the institution remains accountable for the downstream consequences - its reputational and notification costs, as well as regulatory impact are absorbed by default. To my eyes, this looks less like an unintended consequence than a system design failure2.

Share

Second, internal funding models should be interrogated. As every CISO will tell you, they operate within a zero-sum game of the central IT budget. While the CIO controlling that budget may support and try to resource the security office to the best of their ability, the incentive for the CIO is not better cybersecurity. This is fundamentally the structural tension CISOs and CIOs live with. Better and more effective cybersecurity practices are generally invisible when successful. No one gets rewarded for an absence of problems. That is, its success is non-legible (measured as an absence of incidents) and therefore it is structurally under-incentivized.

Third and finally, accountability structures are notoriously obtuse at universities. For cybersecurity it may be tempting to hold the CISO or CIO specifically accountable when a breach or major incident occurs. But this ignores their limited span of control. The mechanisms that hold individuals and units accountable for their engagement with and adoption of cybersecurity practices are highly diffuse and woven throughout academic and administrative structures. Thus, responsibility may be shared, but accountability is rarely concrete.

Clearly there are many ways an experienced organizational leader can approach responding to a data breach. The three areas I detail above each have some obvious interventions. For vendors, refuse to sign misaligned contracts, tier risk, and work hard to enforce vendor liability. This sounds straightforward but your teams will insist that only the preferred product is capable of meeting your institution’s needs. This is never true. Product choice is typically made based on existing vendor partnerships or preferences, user-interface biases, or the trendiness of the product.

As to funding, carve out protected security investment and work with your team to define risk appetite explicitly. Recognize that your team has been trained to undersize resource requests based on what they think is reasonably likely to be funded. I do not recommend inundating your team with emergency resources. Rather, consider a sustained growth model, allowing the team to allocate those resources across staffing and technology according to need. This could look like a protected 10% increase in the security budget annually for five years. With a long time horizon, you enable your team to shift from tactical response to strategic maturation.

Accountability involves tying security participation to existing authority structures. While they can work, I’ve never been a fan of creating a new “Security Governance Council” or something of that ilk. Rather, integrating cybersecurity into the ordinary governance structure of your deans and unit heads is more likely to ensure broad and persistent engagement. But this too will fail without your direct participation. Middle managers focus on their leader’s priorities. Regularly asking deans a few probing questions about their unit’s participation in security initiatives and their internal resource allocation to security may be the single most effective action you can take.

The common thread in all of this is agency. Incidents trigger well-developed machinery - legal, technical, procedural - that is necessary but not sufficient. Leadership is required where that machinery cannot operate: in setting direction, shaping incentives, and defining what the organization is optimizing for. If you cede that ground, the response will be at best competent, and yet incomplete.

Subscribe now

Are we in a moment where there is a crisis of the authority of information? And if so, how does this epistemic breakdown affect cybersecurity practice? I find myself reflecting on this question after reading a rather brutal piece on the absence of good faith actors in our civic space. It forced me to think about one of my remaining open questions, number 8, the “Untrustworthiness of the Federal Government as a partner.” When I wrote that, I was really focusing on the dismantling of the federal mechanisms that underpinned national cybersecurity efforts, i.e., threat intelligence. This is the good work we are all used to, coming from the DOD, CISA, and the intelligence community in identifying, analyzing, and disseminating attack TTPs. Further, with the weaponization of the federal bureaucracy to target minority populations and political opponents, the moral imperative is to think through how we can help protect the victims of this harassment.

However, as I think about the issue, particularly in light of the author’s observation that “we have reached a point where information has no value,” I have to ask what this means for us, as cybersecurity and privacy practitioners. I don’t want to rehash here what others have said so eloquently; that is, to detail the space between statement and reality. As we confront this raw reality every day in our news feeds, the crassness and shameless grift of it wounds us all. Instead, perhaps as salve for that wound, I’d rather ask some questions. How will we know when this erosion of reality1 begins to affect our space, that of cybersecurity practice? Will we be able to recognize it? Has it already happened that we’re so busy with the daily struggle, that the erosion has become normalized and we’re effectively blind to its pernicious effect? Essentially, what happens to cybersecurity practice when the broader epistemic environment collapses?

Subscribe now

Some of the cognitive dissonance that this gives rise to stems from the hard, practical nature of technical cybersecurity. Cybersecurity operations depend on empirical signals and measurable events. An intrusion detection signature is a set of specific actions - ports opened, accounts used, vulnerabilities exploited - and like a stone dropped on your foot they are testably real. They work or they don’t; they’re detected or they’re absent. A DDoS generates packets that have an effect on a system. No political machinations can change that. In at least this dimension of cybersecurity, we are all realists.

Of course, in practice, it’s not quite that simple. It is partly true that technical cyber remains epistemically stable, but experts know the interpretive layer is enormous2. Even understanding an intrusion detection alert requires contextualization and nuanced understanding, that is, interpretation. All of these signals and measurable events must be interpreted and trusted within institutions3. And institutions themselves depend on shared epistemic norms.

Perhaps I should define epistemic norm. By this, I mean those shared rules or standards a community uses to determine what counts as valid knowledge, credible evidence, and justified belief. They govern how people decide whether something is true, reliable, or worth believing. With this definition we can reformulate my question: as those epistemic norms collapse - our institutions’ ability to separate credible from non-credible data - how will our function as security and privacy professionals be impacted?

My suspicion is that we need to look elsewhere from the deeply technical dimensions of cybersecurity and focus first on those of strategy and policy. These seem to be the most susceptible to political interference. If the political landscape is largely shaped by misinformation (or even disinformation a.k.a. propaganda) then this will impact national priorities. We’ve already seen this in the cyber space with the “standing down” of federal resources fighting Russian cyber activities and misinformation more generally. Simply stating as national policy “the Russians aren’t engaged in election interference” doesn’t impact Russian activities. But it will impact our response to them.

We’ll see fewer alerts, less analysis, and quite possibly the introduction of supply chain risks. The latter would stem from the status of certain vendors in the supply chain. Epistemic collapse implies a distortion of policy priorities; priorities that impact vendor restrictions and thus introduce supply chain risk. Potentially positive contributors (such as Claude) are forbidden, while potentially negative contributors are allowed to persist (Palantir)4. These are explicitly political policy decisions made, not for the general health of democracy, but for the benefit of a small number of individuals at its expense. “Russia, if you're listening, I hope you're able to find the 30,000 emails that are missing, I think you will probably be rewarded mightily by our press.” Statement to consequence in 24 hours5.

The more general question for us is to what degree do we allow national priorities to shape or determine our local decisions? And if the priority is based on misinformation, how are we to respond? I suspect part of the answer is that our leadership is awash in the misinformation flood. As with all of us, even the most intelligent and critically thinking among them are still susceptible to its influence, particularly since they likely lack the domain expertise for cyber and geopolitics necessary to insulate themselves from it.

In response, we should step up to this challenge and actively work to clarify for our leadership how civic political discourse combined with geopolitical reality influences our cybersecurity strategy. This is not some variation of “speaking truth to power”, but rather embracing our role of mediating between the reality of cybersecurity and the misinformation-sphere. We need to be clear on how our posture is built on first principles and empirical evidence. But be prepared to have a response ready when drivel like this is sent to you with the question “how does this affect us?”6

Share

Throughout this blog, I’ve spoken often about thought work and how central it is to effective cybersecurity. Yet we find ourselves floating in an ocean of misinformation7. Critically, we need to ask, if the epistemic ecosystem itself is under collapse, how will that trickle down into our own ways of doing thought work? How do we introduce resilience into our own critical thinking about cybersecurity? This is incredibly challenging and the threat is quite insidious, particularly due to the scale of disinformation. I see no liferafts8 and it’s hard to imagine that it hasn’t already damaged us.

My instinct is to try and pivot from an attitude of response, watching for the corrosion and then taking action, to one of anticipation and preemption. To begin with, this means having a clear path you’re following, established through deliberation and clarity of thought, rather than one of reacting to the chaos surrounding you. Have you established and codified a formal cybersecurity strategy - a playbook for the near- to midterm that will provide crisp guidance requiring minimal interpretation? To some degree this is a strategy of insulation, one that will minimize the opportunities for epistemic collapse to interfere with your program.

I can see an entire portfolio of research ideas stemming from the challenge of epistemic collapse or corruption. These revolve around the notion that cybersecurity organizations should strive to preserve epistemic integrity. What are the institutional designs that resist epistemic corruption? What are the analytical methods that remain robust under misinformation pressure? We tend to bandy around the term ‘governance’ to refer to the institutional oversight of a function. But we need to remember that we, as cybersecurity leaders and privacy professionals, are ourselves agents of governance - we govern through our management and strategic capacity. As such we mediate between reality and institutional decisions. And it is in this spirit that the true research question is better stated as how to create epistemic resilience in cybersecurity governance.

Essentially this is a call to action for the academic and professional community to treat epistemic integrity as a formal requirement of modern security. Surely this call must go beyond merely cybersecurity and extend to the entire space of information sciences. But for us in cybersecurity, we must embrace the call to protect not only systems and data but the epistemic foundations that allow us to understand threats in the first place.

Subscribe now