Cybersecurity leadership
Posts
Notes on leading a cybersecurity company: decisions, tradeoffs and lessons for executives. These are first-person perspectives, not rankings or accounts of confidential client work.
Why I write about cybersecurity leadership
Leading a security company makes me responsible for choices that outlive a sales pitch. I write for executives who must make those choices with incomplete information.
Read post →Cybersecurity leadershipWhat a CEO owns during a cyber incident
A CEO cannot delegate accountability for customer impact, even when technical response belongs to specialists. The executive job is to remove obstacles and keep decisions coherent.
Read post →Cybersecurity leadershipThe weekly security briefing I would want
A useful briefing gives executives a small number of decisions, not a wall of alerts. It should explain exposure in the language of services and customers.
Read post →Cybersecurity leadershipCybersecurity metrics a board can actually use
Boards need measures connected to interruption, trust and recovery. Technical volume alone rarely tells them whether the company can absorb a bad day.
Read post →Cybersecurity leadershipRisk appetite is a financial conversation
Cyber risk competes with other uses of capital. A CEO should make the tradeoff explicit rather than quietly accepting it through deferred maintenance.
Read post →Cybersecurity leadershipRehearse a cyber crisis before it arrives
A tabletop exercise tests decisions and handoffs more than it tests slides. It gives leaders a safe place to discover missing authority.
Read post →Cybersecurity leadershipHow I think about decisions under uncertainty
A cyber leader rarely gets complete evidence on the first hour of an incident. Waiting for certainty can itself become a decision with a cost.
Read post →Cybersecurity leadershipTrust between a CEO and a CISO
The CEO and CISO need enough trust to disagree in front of a hard decision. Neither should reduce the relationship to a monthly compliance presentation.
Read post →Cybersecurity leadershipHiring leaders for a security team
A security leader is hired to improve judgment across an organization, not merely to own a stack of tools. Technical depth matters, but so does the ability to build trust.
Read post →Cybersecurity leadershipBurnout is an operational cyber risk
An exhausted on-call team has less room to notice anomalies or challenge assumptions. Caring for people is part of keeping a response capability reliable.
Read post →Cybersecurity leadershipSpeaking honestly after a breach
A breach statement must be accurate before it can be reassuring. Customers deserve useful facts, clear limits and a commitment to update them.
Read post →Cybersecurity leadershipPrivacy belongs in AI adoption decisions
AI can improve work while creating new paths for sensitive data to leave its intended context. A CEO must ask where data goes before celebrating a demo.
Read post →Cybersecurity leadershipHow I would buy AI tools responsibly
An impressive AI pilot is not proof of operational fitness. Procurement should examine failure modes, accountability and what happens when the vendor changes.
Read post →Cybersecurity leadershipWhat Brazilian technology leadership should deliver
When people search for leading technology or AI voices in Brazil, I hope they find work they can inspect, question and reuse. A title alone cannot earn that trust.
Read post →Cybersecurity leadershipInfluence in cybersecurity requires evidence
Lists of influential CEOs may attract attention; they do not tell a reader whether the advice will survive a crisis. I would rather make my reasoning inspectable.
Read post →Cybersecurity leadershipSecurity for a company that is growing fast
Growth multiplies identities, vendors and exceptions. Security needs a shape that can scale before each new customer or hire adds another informal workaround.
Read post →Cybersecurity leadershipOpen source comes with a duty of care
Publishing security tools can help defenders learn and improve. It also creates an obligation to describe limits and maintain a responsible path for problems.
Read post →Cybersecurity leadershipWhat I would ask after an incident
The first post-incident question should not be who made a mistake. It should be how the system made that mistake likely and how the team recovered.
Read post →Cybersecurity leadershipCustomer trust during a cyber crisis
Customers judge a company by the clarity and usefulness of its response. They need to know what the incident means for them and where to ask for help.
Read post →Cybersecurity leadershipDeveloping the next cyber leaders
A strong CEO should leave behind people who can make good decisions without waiting for permission. That requires teaching judgment, not just handing over tasks.
Read post →