After over 30 years in cybersecurity—leading security programs for global enterprises, navigating compliance audits, and managing vendor risk—I've seen firsthand how organizations often confuse compliance with security. It's easy to believe that passing an audit, obtaining a certification, or filling out an Excel checklist equates to being secure. But real security isn't about checking boxes—it's about understanding and mitigating risk in a practical, business-aligned way.
Throughout my (somewhat sordid) career at companies big and small—SafeBreach, Experian, E*TRADE, and Wells Fargo, to name a few—I've worked through the challenges of balancing security, compliance, and operational efficiency. I've built security programs, developed governance frameworks, and ensured regulatory compliance with SOC 1/2, ISO 27001, GDPR, and more. And along the way, I've seen how the audit and certification industry, while necessary, often reinforces the illusion of security rather than actual protection.
One of the most memorable keynotes I've attended was by one of the most colorful people I've had the privilege to associate with — Chris Roberts . He made a cheeky yet brutally accurate reference to the "Check in the Box" security mindset in his talk. It resonated deeply because I've seen it everywhere.
Another major issue in cybersecurity today is managing talent—from recruiting the right professionals to ensuring they have the skills and mindset necessary to address real threats. Similarly, security isn't just about tools, policies, and procedures; it requires strong leadership, a security-first culture, and a focus on risk reduction that improves security rather than just satisfying compliance requirements.
This series will explore why cybersecurity needs to move beyond the checklist mentality. We'll discuss:
🔷 The Illusion of Security—why passing an audit doesn't mean you're safe
🔷 The Compliance Trap—how regulations shape security (for better and worse)
🔷 Real Security vs. Excel Checklist Security—why risk-based strategies matter
🔷 Beyond Checkbox Governance—why security must go beyond policies and procedures to become a truly embedded practice
🔷 Strategic Goals vs. Tactical Initiatives—why organizations often confuse long-term security strategy with short-term fixes
🔷 The Role of Executives and the Board—why cybersecurity is a business issue, not just an IT problem, and how leaders should engage beyond surface-level oversight
🔷 Bridging the Gap Between Security and Business Goals—why security must align with business objectives rather than obstruct them
🔷 The Culture of Security—how leadership drives (or undermines) security awareness and accountability
🔷 Managing Cybersecurity Talent—how to attract, develop, and retain the right people in an industry facing a skills shortage
🔷 The Audit and Certification Industry—does it create security or just the appearance of it?
🔷 Vendor Risk Management—how to assess third-party security without just sending another questionnaire
🔷 Security Questionnaires—why they often miss the mark and how to improve the process
🔷 Cyber Insurance—its role, limitations, and how it fits into a holistic security strategy
🔷 Personal Certifications and Education—what they mean, what they don't, and how to develop real expertise
🔷 It's Not Just About the Tools—why technology alone won't solve security challenges, and how to use tools effectively without relying on them as a crutch
🔷 Measuring and Testing What Matters—rethinking security metrics to reflect risk reduction, with an emphasis on continuous testing and verification
Yes, the irony of talking about the deficiencies of checklist security while presenting these deficiencies as a list isn't lost on me. I did it on purpose.
A former team member, Jonathan Savage , once introduced me to a quote by George E.P. Box:
"All models are wrong, but some are useful."
I'll add my corollary:
"All checklists are lacking, but some are useful."
I plan to write this series not just to generate content or point out flaws. We are all keenly aware of these flaws. I want to explore pragmatic solutions and approaches to address them. When leading security teams, I didn't just want people to point out problems—I expected them to bring solutions or suggest actionable approaches. That mindset turns complaints into meaningful discussions and, ultimately, tangible improvements.
What's my ultimate goal in writing this series?
I want to help others overcome the checklist mentality and build real security programs that protect businesses, customers, and data without unnecessary bureaucracy or wasted effort. Based on my experiences leading security at multiple organizations, I'll share insights on making cybersecurity more practical, effective, and resilient.
Let's rethink security together.
#Cybersecurity #RiskManagement #SecurityLeadership #BeyondCompliance #CISOStrategy #InfoSec #Governance #CyberResilience #PragmaticSecurity #Leadership