In honor of the death of the CIA World Factbooks, another Phil & the CISO moment.
CISO: If you need some basic info forecasts for travel you c...
Me: OH NEAT! You have factbooks. I loved these in high school.
CISO: High school?
Me: Oh yeah. Great reading. [begins flipping through one on Kazakhstan]
CISO: If you need some basic info forecasts for travel you c...
Me: OH NEAT! You have factbooks. I loved these in high school.
CISO: High school?
Me: Oh yeah. Great reading. [begins flipping through one on Kazakhstan]
The result of my training.
Me: If I understand all this right, the key's to have no shame.
CISO: Hmm?
Me: If I react to blackmail material with "Those pics are bitchin'. Can I have one to send my mom?" they have none.
CISO: That...yes, but no.
Me: No shame = rock solid clearance.
CISO: [rubs eyes]
Me: If I understand all this right, the key's to have no shame.
CISO: Hmm?
Me: If I react to blackmail material with "Those pics are bitchin'. Can I have one to send my mom?" they have none.
CISO: That...yes, but no.
Me: No shame = rock solid clearance.
CISO: [rubs eyes]
February 5, 2026 at 4:11 PM
In honor of the death of the CIA World Factbooks, another Phil & the CISO moment.
CISO: If you need some basic info forecasts for travel you c...
Me: OH NEAT! You have factbooks. I loved these in high school.
CISO: High school?
Me: Oh yeah. Great reading. [begins flipping through one on Kazakhstan]
CISO: If you need some basic info forecasts for travel you c...
Me: OH NEAT! You have factbooks. I loved these in high school.
CISO: High school?
Me: Oh yeah. Great reading. [begins flipping through one on Kazakhstan]
We have heard that CDC’s Chief Information Security Officer (CISO) resigned today. This is bad news for the security of CDC databases.
February 20, 2025 at 11:07 PM
We have heard that CDC’s Chief Information Security Officer (CISO) resigned today. This is bad news for the security of CDC databases.
CISO: [appraising look] Okay, if you already know what those are you're already better informed than most people.
Me: Can I borrow this?
CISO: No, but I can make copies of pages. You don't even remember what you came her for anymore, do you?
Me: Travel guidance?
CISO: To where?
Me: Shit.
Me: Can I borrow this?
CISO: No, but I can make copies of pages. You don't even remember what you came her for anymore, do you?
Me: Travel guidance?
CISO: To where?
Me: Shit.
February 5, 2026 at 4:14 PM
CISO: [appraising look] Okay, if you already know what those are you're already better informed than most people.
Me: Can I borrow this?
CISO: No, but I can make copies of pages. You don't even remember what you came her for anymore, do you?
Me: Travel guidance?
CISO: To where?
Me: Shit.
Me: Can I borrow this?
CISO: No, but I can make copies of pages. You don't even remember what you came her for anymore, do you?
Me: Travel guidance?
CISO: To where?
Me: Shit.
The Cyber Reality of the CEO/CISO/CIO/CTO
November 17, 2024 at 7:20 AM
The Cyber Reality of the CEO/CISO/CIO/CTO
I was acting CISO for a company for year or so. That taught me that I never want to be a CISO.
December 10, 2024 at 9:32 PM
I was acting CISO for a company for year or so. That taught me that I never want to be a CISO.
Wanting CISO because it's the final boss makes you a gamer not a professional
December 10, 2024 at 9:35 PM
Wanting CISO because it's the final boss makes you a gamer not a professional
CISO is absolutely dumbfounded, looks at man and says "So what do you call this technology", man says "The Aristocrats" except the joke is that it's bearer tokens do you get the joke
September 25, 2026 at 7:22 AM
CISO is absolutely dumbfounded, looks at man and says "So what do you call this technology", man says "The Aristocrats" except the joke is that it's bearer tokens do you get the joke
The result of my training.
Me: If I understand all this right, the key's to have no shame.
CISO: Hmm?
Me: If I react to blackmail material with "Those pics are bitchin'. Can I have one to send my mom?" they have none.
CISO: That...yes, but no.
Me: No shame = rock solid clearance.
CISO: [rubs eyes]
Me: If I understand all this right, the key's to have no shame.
CISO: Hmm?
Me: If I react to blackmail material with "Those pics are bitchin'. Can I have one to send my mom?" they have none.
CISO: That...yes, but no.
Me: No shame = rock solid clearance.
CISO: [rubs eyes]
February 2, 2026 at 6:14 PM
The result of my training.
Me: If I understand all this right, the key's to have no shame.
CISO: Hmm?
Me: If I react to blackmail material with "Those pics are bitchin'. Can I have one to send my mom?" they have none.
CISO: That...yes, but no.
Me: No shame = rock solid clearance.
CISO: [rubs eyes]
Me: If I understand all this right, the key's to have no shame.
CISO: Hmm?
Me: If I react to blackmail material with "Those pics are bitchin'. Can I have one to send my mom?" they have none.
CISO: That...yes, but no.
Me: No shame = rock solid clearance.
CISO: [rubs eyes]
Nobody who holds such a role calls it 'Chief of Cybersecurity'.
You're referring to the CISO, and the CISO absolutely does not have the creds to pear into the logs for such trivial nonsense. If the CISO does have access, you've failed at your job.
You're referring to the CISO, and the CISO absolutely does not have the creds to pear into the logs for such trivial nonsense. If the CISO does have access, you've failed at your job.
July 4, 2025 at 5:28 PM
Nobody who holds such a role calls it 'Chief of Cybersecurity'.
You're referring to the CISO, and the CISO absolutely does not have the creds to pear into the logs for such trivial nonsense. If the CISO does have access, you've failed at your job.
You're referring to the CISO, and the CISO absolutely does not have the creds to pear into the logs for such trivial nonsense. If the CISO does have access, you've failed at your job.
the existence of a fractional CISO implies the existence of an irrational CISO
October 23, 2025 at 11:52 PM
the existence of a fractional CISO implies the existence of an irrational CISO
There ain't nothing scarier in this world than a CISO who can suss-out assertions you don't have the data for, and asks to see it.
October 25, 2025 at 7:20 PM
There ain't nothing scarier in this world than a CISO who can suss-out assertions you don't have the data for, and asks to see it.
This is really well written, if you want to scare your CISO, send them this for Halloween. 🎃
🧯The security community is pushing back against new claims that 80% of #ransomware attacks are AI-driven, a figure from a recent MIT-linked report now drawing widespread criticism. →
socket.dev/blog/securit...
socket.dev/blog/securit...
Security Community Slams MIT-linked Report Claiming AI Power...
Experts push back on new claims about AI-driven ransomware, warning that hype and sponsored research are distorting how the threat is understood.
socket.dev
October 31, 2025 at 11:32 AM
This is really well written, if you want to scare your CISO, send them this for Halloween. 🎃
(me thinking very hard) nickit iso file
April 27, 2026 at 3:33 PM
(me thinking very hard) nickit iso file
I am the person at the CISO event gesturing wildly while giving a condensed lecture on the life of baroque painter Artemisia Gentileschi. I am very fun at parties.
June 18, 2026 at 5:52 PM
I am the person at the CISO event gesturing wildly while giving a condensed lecture on the life of baroque painter Artemisia Gentileschi. I am very fun at parties.
"Implement least privilege. When in doubt, default deny."
Aspiring CISO, writing: Got it, allow nothing.
“Implement least trust. In fact, zero trust."
Aspiring CISO: Got it, trust nothing.
“And whatever you do, don't be the department of no"
Aspiring CISO: ...Back up a bit.
Aspiring CISO, writing: Got it, allow nothing.
“Implement least trust. In fact, zero trust."
Aspiring CISO: Got it, trust nothing.
“And whatever you do, don't be the department of no"
Aspiring CISO: ...Back up a bit.
June 9, 2025 at 1:48 PM
"Implement least privilege. When in doubt, default deny."
Aspiring CISO, writing: Got it, allow nothing.
“Implement least trust. In fact, zero trust."
Aspiring CISO: Got it, trust nothing.
“And whatever you do, don't be the department of no"
Aspiring CISO: ...Back up a bit.
Aspiring CISO, writing: Got it, allow nothing.
“Implement least trust. In fact, zero trust."
Aspiring CISO: Got it, trust nothing.
“And whatever you do, don't be the department of no"
Aspiring CISO: ...Back up a bit.
Oh no! What's their CISO doing? *checks notes* oh no
NEW: Insane screwup inside Meta. The company exposed worker keystroke data that was being used to train AI — making it potentially accessible to anyone at the company.
The data included personnel and performance info, private convos, full transcriptions…imagine your coworkers seeing all of that.
The data included personnel and performance info, private convos, full transcriptions…imagine your coworkers seeing all of that.
Meta Exposed Data Internally From Its Controversial Employee-Tracking Program
Employees had previously raised concerns about the initiative, which involves collecting workers’ keystroke data to train AI models.
www.wired.com
June 23, 2026 at 2:12 AM
Oh no! What's their CISO doing? *checks notes* oh no
I am not kidding if you work in cybersecurity somewhere that has any kind of contracts with the US government you need to be texting your CISO today and getting in front of this
February 2, 2025 at 5:42 PM
I am not kidding if you work in cybersecurity somewhere that has any kind of contracts with the US government you need to be texting your CISO today and getting in front of this
I need to work on my bio
November 19, 2025 at 12:49 AM
I need to work on my bio
UPDATE: OpenAI is removing the feature following my reporting, and is working to remove indexed chats. "We think this feature introduced too many opportunities for folks to accidentally share things they didn't intend to," admits OpenAI's CISO.
August 1, 2025 at 6:10 AM
UPDATE: OpenAI is removing the feature following my reporting, and is working to remove indexed chats. "We think this feature introduced too many opportunities for folks to accidentally share things they didn't intend to," admits OpenAI's CISO.
I say this as a CEO: From now on, when children’s health data is compromised because multi factor authentication was not enforced, fire the CEO, not the CISO. I mean, sure, fire the CISO as well, but the CEO bears the responsibility. arstechnica.com/security/202...
Data breach hitting PowerSchool looks very, very bad
Schools are now notifying families their data has been stolen.
arstechnica.com
January 24, 2025 at 9:26 PM
I say this as a CEO: From now on, when children’s health data is compromised because multi factor authentication was not enforced, fire the CEO, not the CISO. I mean, sure, fire the CISO as well, but the CEO bears the responsibility. arstechnica.com/security/202...
A.I. vormt op veel meer vlakken dan security en milieu een bedreiging. Het vormt ook een bedreiging voor onze democratie.
Ik sprak erover voor CISO praat met voormalig Europarlementariër Marietje Schaake.
Luister de aflevering nu:
open.spotify.com/episode/1O3c...
Ik sprak erover voor CISO praat met voormalig Europarlementariër Marietje Schaake.
Luister de aflevering nu:
open.spotify.com/episode/1O3c...
September 27, 2026 at 8:06 AM
A.I. vormt op veel meer vlakken dan security en milieu een bedreiging. Het vormt ook een bedreiging voor onze democratie.
Ik sprak erover voor CISO praat met voormalig Europarlementariër Marietje Schaake.
Luister de aflevering nu:
open.spotify.com/episode/1O3c...
Ik sprak erover voor CISO praat met voormalig Europarlementariër Marietje Schaake.
Luister de aflevering nu:
open.spotify.com/episode/1O3c...