This Is GRC

Original writing

The archive.

I wrote these between 2022 and 2025, on GRC, security, technology and the people doing the work. Original words, original dates.

2025

The Truth About Cybersecurity Certifications

Let's piss off every cybersecurity influencer, bootcamp, and certification body whose marketing strategy relies on the deception that there are "millions of unfilled cyber jobs," shall

It's Cool to Hate Security Vendors

If you spend enough time on LinkedIn, you'll encounter these posts by security directors, VPs or CISOs. Mocking cold calls. Taking a jab at conference booths. Gaslighting SDRs that do bad cold outreach. You know the

What Makes a GRC Specialist Great?

Don't worry. I'm not about to spend the next 1,000 words of your time telling you about how great I am. I'm still figuring this out. Think of it like an ideal to

Presence Over Process

I’ve spent most of my career in GRC trying to find ways to make security relevant. And somewhere along the way, I realized the difference isn’t in the frameworks. It’s not in the policies. It’s not even in how mature

The Future of GRC in the AI-Hype World

If you work in GRC today, you've probably noticed the tsunami of AI hype washing over our industry. Every vendor, consultant, and LinkedIn influencer seems to be positioning themselves as an "AI security expert" (myself

Start Here

Transform into the GRC leader modern companies fight

Security Questionnaires Aren't Making Anyone Safer

Let's be brutally honest about what Third-Party Risk Management currently is: a soul-crushing bureaucratic charade that wastes everyone's time, kills business momentum, and miraculously manages to make security worse in

Beyond Compliance

Your compliance program is about to be automated out of

The Communications Game

Here's my story about how I became convinced that communications was the core skill to master when working in GRC. Now, let me preface this with a big caveat: I'm not going to pretend I'm some mastermind here. I'm still

We Can’t Train Everyone. That’s the Truth.

Every few weeks, I come across another frustrated post from someone trying to "break into cybersecurity". The story is familiar: they’ve done the bootcamp, passed a certification, maybe even applied to a dozen roles.

GRC is Technical

The myth that GRC is the easy, nontechnical side of security still does damage.

When I Stopped Needing to Be Right

When I first got into GRC, I thought my job was to be the expert. You know, the one with the right answers. The one who had the policy ready. The one who flagged the risk before it

2024

How to Balance Security and Privacy?

Can your employer's IT department view your internet browsing? Can they spy on you with their mobile device management software? I get this question commonly. The answer depends on the software, but I often say, "

Why security must not report to IT

Last week, I participated in a recruiting activity as part of an event. The highlight was having lunch with one of my former managers whom I hadn't spoken with in a few years. He inquired about how satisfied I was at my

Cybersecurity is all about relationships

As of writing this, a colleague I hold dear announced that she was leaving the company for personal reasons. The news saddened me. I don’t believe in company loyalty. I believe we are loyal to the people around

Do you need to learn to code to work in cybersecurity?

Are you interested in a career in information security? It's normal to wonder how long you would spend learning different skills to get there, especially coding. But, allow me to be brutally honest here: asking if you

2023

You don’t go into cybersecurity to make friends

“If I wanted to make friends I wouldn’t work in security”, he yelled, smashing the phone on his desk. He put his jacket back on and stormed off while I looked toward my other colleague, blushing,

How to incorporate security into your branding strategy?

The most unexpected benefit I got from this newsletter is the content marketing skills I've built along the way. Speaking the "brand" language brought me closer to my employer's marketing team. In the past year, the

How to handle conflicts in information security

If you dislike conflicts, don't work in information security. As a mentor once told me: "I'm not in security to make friends." Don't get me wrong. The vast majority of InfoSec professionals are easygoing. Conflicts are

The importance of cybersecurity: Who are we protecting?

A few weeks ago, a friend was caught in a hospitality cyber-fraud . The threat actors infiltrated the hotel's booking.com accounts. Using this valid account, they sent fraudulent emails asking for a credit card

Are You Prepared for Next-Gen Phishing Threats?

I hate to admit it: I was caught once by my company's phishing simulation campaign. I was late to pick up my kids, I knew my password was expiring, I entered my credentials. And the rest is

The Cyber Threats in Universities Nobody's Talking About

This week was the back-to-school frenzy. These days, with four boys, the whirlwind is all about survival for me: kindergarten, primary and secondary school simultaneously . This chaos breeds nostalgia. I remember how

10 Harsh Truths About Cloud Security

I completed over 400 cloud third-party risk assessments. Working for a cloud vendor, I also participated in over 200 due diligence processes. I'm on both sides of the fence. This position provides me with unique

Why is security so expensive?

It was a challenging customer audit. The customer wanted us to have a specific piece of security technology. My attempts to explain how the alternative measures we had in place met the same requirements were falling on

Why the Media Should Stop Reporting on Security Breaches

A crucial part of my job involves advising incident responders about the definition of a "security incident". This is not as straightforward as you think! Sure, ransomware is easy to identify. But 99% of security events

Common Security Analyst Mistakes to Avoid

Let me tell you a horror story about a security consultant. That person had been hired for a specific mandate. By the end of it, people were actively running away from him. They asked other security people, such as the

How much does a security breach cost?

"We wouldn't want our payroll information leaking and everyone to know their colleague's salaries!" This is one of the most frequent remarks I hear when discussing security with senior leadership. Here's a provocative

What is ISO27001 Certification?

The company I have been working for the past 4.5 years recently obtained the ISO27001 certification. It's a pretty cool milestone and I'm glad I got to take a part in that process. Getting a certification like that as

How do ChatGPT and other LLMs get hacked?

"AI is going to take over the world!" How many times have you read that online in the past week? How about the opposite? How can someone take over AI? That seems to me like a scarier

Selling InfoSec Differently

This week, ppfosec turns 1 year old ! I am so grateful that you are giving me some of your time every week. The best experiences for me were the DMs you sent me every Wednesday telling me how I’ve helped you. Since I’m

Who is behind ransomware attacks?

When I was a teen, MP3s were the revolution. I was raised in a small country town. Our music store large as a closet sold non-Celine Dion CDs for $25 (if you want to get depressed, Google how much that does today with

Can IoT Devices Be Hacked?

Have you recently shopped for a refrigerator? If so, you've probably noticed two weird trends. One: why do they need transparent doors when you can open them? And two: what's with putting a screen on them? Why does

Mental Health in Cybersecurity: the Hidden Threat

How stressful is your job? Each occupation comes with its own set of challenges, and information security is no exception. As part of mental health awareness month, this week I explore specific challenges we face in our

What is a cookie?

Just this year, my children's school banned Pokémon cards and mangas. It’s funny. When I was a kid, my school banned mangas, too. And pogs! How things always do come full

What is online search and how does it work?

Have you ever wished one page about you went away from Google? I did. Back in 2012, I blogged about local politics in a national newspaper and responded to people in the comments section. Whenever I googled myself, I

What is DevOps?

It's hard to grasp the intricacies of an organization's information technology (IT) department. Most people only have contact with IT as "the computer guy" who fixes laptops and resets

How Criminals Will Use Generative AI to Scam Us

The recent mainstream success of generative AI promises to make us more productive, and that includes cybercriminals . "But ChatGPT has safeguards!", I hear you say. Well, this researcher believes we could train a large

What is a Database?

Ever wondered how the scan at the grocery store's cashier gets you the item's price? Basically, the infrared scanner translates the information encoded in the bar code into a digital identifier, then the computer

What is an API?

API is the most interesting technical term for me because hearing it is the easiest way to spot developers at parties (okay, I admit, as a dadx4, I only attend children's birthday parties, but the point still stands).

Why Are So Many Companies Getting Hacked?

I got a weird credit card transaction notification during my son's birthday party a few weeks ago. I looked up the records and filed a report. It took about 10 minutes, but I remained distracted by the incident for an

2022

Is AI About to Take Your Job?

It was 2009. I was a temporary worker for the government. This is the worst position you can have: all the disadvantages of being unionized, without any of the

How To DevSecOps

I spent a good portion of my first internship in cybersecurity supporting a large IT operations department in the financial sector. I created service accounts with minimal permissions, maintained firewall

Exclusive: Security Absent from Twitter Terms

In August 2022, the former Twitter Chief Information Security Officer made incendiary allegations against Twitter. I decided I would go through Twitter's publicly available contracts to determine the gap between the

It's Always a Question of Identity

While I'm a GRC specialist, I'll always keep a fondness for Identity and access management. I love IAM for the same reason most hate it: it's embedded into organizational complexity, there's an infinite amount of edge

Ransomware Running Rampant

Insurance and security companies have grown so used to ransomware that cyber-threat researchers can now become "negotiators". One of them shares his experience to the register . Based on previous discussions with

The Money Problem in Cybersecurity

You probably got into cybersecurity because it seemed like a smart, future-proof move. Maybe you saw the salary ranges on Glassdoor. Maybe someone on LinkedIn told you there are “1 million unfilled jobs.” The message

Remote workforce giving new meaning to "fishing trip"

Sometimes I wish we, infosec specialists, were better at "reading the room". A report from Tessian reveals that 56% of IT leaders believe employees are "cutting corners" when not in the office. The main concern seems

My CISSP story

I got into infosec because of the TV show Mr. Robot. Of course, my initial idea was to become a pentester! While ethical hacking was enthralling, I quickly discovered my knack for delivering awesome risk assessment