<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Risk and Cyber ]]></title><description><![CDATA[Risk and Cyber ]]></description><link>https://www.philvenables.com/home</link><generator>RSS for Node</generator><lastBuildDate>Wed, 22 Apr 2026 01:30:46 GMT</lastBuildDate><atom:link href="https://www.philvenables.com/blog-feed.xml" rel="self" type="application/rss+xml"/><item><title><![CDATA[Maintenance of Everything : A Review]]></title><description><![CDATA[I haven’t done a book review for a while and there’s no better way to get back to this than a look at Stewart Brand’s Maintenance of Everything . Stewart developed a lot of this book in an open editing process and so the final delivery of what is Part 1 of a forthcoming series was all the more anticipated.  I’ve long been obsessed with the need for maintenance in the context of technology risk management, security and reliability. A big part of technical debt build up and the security...]]></description><link>https://www.philvenables.com/post/maintenance-of-everything-a-review</link><guid isPermaLink="false">69db2d3a75afb0779a73c6a8</guid><category><![CDATA[Cybersecurity]]></category><category><![CDATA[Technology]]></category><pubDate>Sat, 18 Apr 2026 10:45:19 GMT</pubDate><dc:creator>Phil Venables</dc:creator></item><item><title><![CDATA[The Real Role of the Field CISO]]></title><description><![CDATA[We all need to advance our businesses and that is in many respects about selling. We also need to recognize that security and reliability are increasingly the path to sustainable long term customer success - which is your success. This is where the Field CISOs come in.  There are many more people that are becoming, so called, Field CISOs and many more organizations that are creating Field CISO teams under a variety of structures and names. Let’s look at what Field CISOs are, why they exist,...]]></description><link>https://www.philvenables.com/post/the-real-role-of-the-field-ciso</link><guid isPermaLink="false">69c41196043183ace6e0520b</guid><category><![CDATA[Leadership]]></category><category><![CDATA[Cybersecurity]]></category><pubDate>Sat, 04 Apr 2026 13:32:43 GMT</pubDate><dc:creator>phil7672</dc:creator></item><item><title><![CDATA[Organizational Politics &#38; The Security Program ]]></title><description><![CDATA[I first wrote the original of this post over 4 years ago. Having seen a new spurt of discussion about organization politics in various on-line and in-person forums I thought it was time for an update.  At every stage in your career and in every part of your role you are going to have to deal with organizational politics. People often construe such politics as inherently negative. Yes, there are some organizations that have toxic cultures where organizational politics looks more like chicanery...]]></description><link>https://www.philvenables.com/post/organizational-politics-the-security-program</link><guid isPermaLink="false">69b563b75f6a1e874c56cd6c</guid><category><![CDATA[Leadership]]></category><category><![CDATA[Technology]]></category><category><![CDATA[Cybersecurity]]></category><category><![CDATA[Risk]]></category><pubDate>Sat, 21 Mar 2026 11:29:27 GMT</pubDate><dc:creator>phil7672</dc:creator></item><item><title><![CDATA[Cybersecurity’s Need for Speed &#38; Where To Find It]]></title><description><![CDATA[As we talked about in the last post , a world going through a massive AI-driven transition means speed becomes vital. This is the speed of adapting to change and the speed of dealing with a world of threats, who are themselves moving ever faster.  It’s easy to say go faster but this has to be more than just wishful thinking or a line in a strategy document. You actually have to go do some things. You also have to push back against some of the defeatism that permeates a lot of the security...]]></description><link>https://www.philvenables.com/post/cybersecurity-s-need-for-speed-where-to-find-it</link><guid isPermaLink="false">69ac3c4e9992c96cd84a6e3b</guid><category><![CDATA[Risk]]></category><category><![CDATA[Cybersecurity]]></category><pubDate>Sat, 07 Mar 2026 15:08:59 GMT</pubDate><dc:creator>phil7672</dc:creator></item><item><title><![CDATA[Things Are Getting Wild: Re-Tool Everything for Speed ]]></title><description><![CDATA[It’s not often that a force appears that totally re-orients everything in security. This is what we are facing with AI.  12 months ago I had an incrementalist view of the cybersecurity impact of AI. Specifically, that it will be very significant but things will change progressively and we’ll adapt to adversarial use while also using it to improve defenses.  Now, I’m coming to a view that this will have a bigger negative impact than even our worst assumptions. But at the same time, it...]]></description><link>https://www.philvenables.com/post/things-are-getting-wild-re-tool-everything-for-speed</link><guid isPermaLink="false">6994888a31440415cc6836b6</guid><category><![CDATA[Risk]]></category><category><![CDATA[Cybersecurity]]></category><category><![CDATA[Technology]]></category><pubDate>Sat, 21 Feb 2026 16:08:46 GMT</pubDate><dc:creator>Phil Venables</dc:creator></item><item><title><![CDATA[Security Implications of DORA AI Capabilities Model]]></title><description><![CDATA[The DORA AI Capabilities Model  (DevOps Research and Asssesment, not the EU Digital Operational Resilience Act) report is well worth a read not just to get a perspective from the developer community but to look at the many security implications it uncovers. This post is a summary of the explicit findings and some of broader implications from reading between the lines of the report. 1. Data Protection and Access Control A primary security concern is ensuring AI tools respect existing...]]></description><link>https://www.philvenables.com/post/security-implications-of-dora-ai-capabilities-model</link><guid isPermaLink="false">69850c767004b379054f97fb</guid><category><![CDATA[Cybersecurity]]></category><category><![CDATA[Technology]]></category><pubDate>Sat, 07 Feb 2026 13:23:17 GMT</pubDate><dc:creator>phil7672</dc:creator></item><item><title><![CDATA[The CISO's Craft: Watchmaker or Gardener?]]></title><description><![CDATA[Some time ago I saw a comment about the distinction between acting like a “watchmaker” or a “gardener” when undertaking organization transformations. I misplaced the original reference so, unfortunately, I can’t credit appropriately. But, I’ve been thinking a lot about what this would mean in the context of security leadership. Specifically, should the CISO be a watchmaker or a gardener, or both? The Watchmaker CISO: Precision and Control Imagine a master watchmaker, meticulously crafting...]]></description><link>https://www.philvenables.com/post/the-ciso-s-craft-watchmaker-or-gardener</link><guid isPermaLink="false">6970c9f7f2523fcb8430452d</guid><category><![CDATA[Leadership]]></category><category><![CDATA[Cybersecurity]]></category><pubDate>Sat, 24 Jan 2026 16:39:53 GMT</pubDate><dc:creator>Phil Venables</dc:creator></item><item><title><![CDATA[2025 Year in Review - Top 10 ]]></title><description><![CDATA[The most read posts in 2025 coalesced around the concept that successful cybersecurity is fundamentally a function of business leadership, strategic design, and sustainable execution . The unifying themes across the top posts emphasize shifting security from an artisanal, reactive craft to an industrial-scale, proactive capability focused on building scalable, self-reinforcing systems (flywheels). Transformation requires leaders to manage stakeholder expectations carefully, particularly by...]]></description><link>https://www.philvenables.com/post/2025-year-in-review-top-10</link><guid isPermaLink="false">696111c06d2e4f0e09798275</guid><category><![CDATA[Leadership]]></category><category><![CDATA[Risk]]></category><category><![CDATA[Cybersecurity]]></category><category><![CDATA[Technology]]></category><pubDate>Sat, 10 Jan 2026 14:36:22 GMT</pubDate><dc:creator>Phil Venables</dc:creator></item><item><title><![CDATA[Security Leadership Master Class 7 : Contrarian takes]]></title><description><![CDATA[This is the final of the series grouping together sets of prior posts into a particular theme.  Security Leadership Master Class 1 : Leveling up your leadership Security Leadership Master Class 2 : Dealing with the board and other executives Security Leadership Master Class 3 : Building a security program Security Leadership Master Class 4 : Enhancing/refreshing a security program Security Leadership Master Class 5 : Getting hired and doing hiring Security Leadership Master Class 6 : When...]]></description><link>https://www.philvenables.com/post/security-leadership-master-class-7-contrarian-takes</link><guid isPermaLink="false">693d97643557d3f0b4706d80</guid><category><![CDATA[Cybersecurity]]></category><category><![CDATA[Leadership]]></category><pubDate>Sat, 27 Dec 2025 15:12:43 GMT</pubDate><dc:creator>Phil Venables</dc:creator></item><item><title><![CDATA[Security Leadership Master Class 6 : When disaster strikes]]></title><description><![CDATA[This is part 6 of a 7 part series grouping together sets of prior posts into a particular theme.  Security Leadership Master Class 1 : Leveling up your leadership Security Leadership Master Class 2 : Dealing with the board and other executives Security Leadership Master Class 3 : Building a security program Security Leadership Master Class 4 : Enhancing/refreshing a security program Security Leadership Master Class 5 : Getting hired and doing hiring Security Leadership Master Class 6 : When...]]></description><link>https://www.philvenables.com/post/security-leadership-master-class-6-when-disaster-strikes</link><guid isPermaLink="false">693c77e542832d49aeba5363</guid><category><![CDATA[Cybersecurity]]></category><category><![CDATA[Leadership]]></category><pubDate>Sat, 13 Dec 2025 16:15:34 GMT</pubDate><dc:creator>Phil Venables</dc:creator></item><item><title><![CDATA[Security Leadership Master Class 5 : Getting hired and doing hiring ]]></title><description><![CDATA[This is part 5 of a 7 part series grouping together sets of prior posts into a particular theme.  Security Leadership Master Class 1 : Leveling up your leadership Security Leadership Master Class 2 : Dealing with the board and other executives Security Leadership Master Class 3 : Building a security program Security Leadership Master Class 4 : Enhancing/refreshing a security program Security Leadership Master Class 5 : Getting hired and doing hiring Security Leadership Master Class 6 : When...]]></description><link>https://www.philvenables.com/post/security-leadership-master-class-5-getting-hired-and-doing-hiring</link><guid isPermaLink="false">6919f1f380f146b984de31c6</guid><category><![CDATA[Leadership]]></category><category><![CDATA[Cybersecurity]]></category><pubDate>Sat, 29 Nov 2025 14:49:25 GMT</pubDate><dc:creator>Phil Venables</dc:creator></item><item><title><![CDATA[Security Leadership Master Class 4 : Enhancing a Security Program ]]></title><description><![CDATA[This is part 4 of a 7 part series grouping together sets of prior posts into a particular theme.  Security Leadership Master Class 1 : Leveling up your leadership Security Leadership Master Class 2 : Dealing with the board and other executives Security Leadership Master Class 3 : Building a security program Security Leadership Master Class 4 : Enhancing/refreshing a security program Security Leadership Master Class 5 : Getting hired and doing hiring Security Leadership Master Class 6 : When...]]></description><link>https://www.philvenables.com/post/security-leadership-master-class-4-enhancing-a-security-program</link><guid isPermaLink="false">691341331138326033f24ec3</guid><category><![CDATA[Leadership]]></category><category><![CDATA[Cybersecurity]]></category><pubDate>Sat, 15 Nov 2025 15:05:14 GMT</pubDate><dc:creator>Phil Venables</dc:creator></item><item><title><![CDATA[Security Leadership Master Class 3 : Building a security program]]></title><description><![CDATA[This is part 3 of a 7 part series grouping together sets of prior posts into a particular theme.  Security Leadership Master Class 1 : Leveling up your leadership Security Leadership Master Class 2 : Dealing with the board and other executives Security Leadership Master Class 3 : Building a security program Security Leadership Master Class 4 : Enhancing or refreshing a security program Security Leadership Master Class 5 : Getting hired and doing hiring Security Leadership Master Class 6 :...]]></description><link>https://www.philvenables.com/post/security-leadership-master-class-3-building-a-security-program</link><guid isPermaLink="false">69035addf6608571b9366467</guid><category><![CDATA[Leadership]]></category><category><![CDATA[Cybersecurity]]></category><pubDate>Sat, 01 Nov 2025 15:23:14 GMT</pubDate><dc:creator>Phil Venables</dc:creator></item><item><title><![CDATA[Security Leadership Master Class 2 : Dealing with the board and other executives]]></title><description><![CDATA[This is part 2 of this 7 part series grouping together a set of prior posts into a particular theme.  Security Leadership Master Class 1 : Leveling up your leadership Security Leadership Master Class 2 : Dealing with the board and other executives Security Leadership Master Class 3 : Building a security program Security Leadership Master Class 4 : Enhancing or refreshing a security program  Security Leadership Master Class 5 : Getting hired and doing hiring Security Leadership Master Class 6...]]></description><link>https://www.philvenables.com/post/security-leadership-master-class-2-dealing-with-the-board-and-other-executives</link><guid isPermaLink="false">68e950fdc3363e86faf8683c</guid><category><![CDATA[Leadership]]></category><category><![CDATA[Cybersecurity]]></category><pubDate>Sat, 18 Oct 2025 12:53:23 GMT</pubDate><dc:creator>Phil Venables</dc:creator></item><item><title><![CDATA[Security Leadership Master Class 1 : Leveling up your leadership]]></title><description><![CDATA[This is the first of a 7 part series where I’ll group together a set of prior posts into a particular theme that will make it all the...]]></description><link>https://www.philvenables.com/post/security-leadership-master-class-1-leveling-up-your-leadership</link><guid isPermaLink="false">68de6ccdb65ca6006d560530</guid><category><![CDATA[Leadership]]></category><category><![CDATA[Cybersecurity]]></category><pubDate>Sat, 04 Oct 2025 14:46:17 GMT</pubDate><dc:creator>Phil Venables</dc:creator></item><item><title><![CDATA[Good CISO / Bad CISO]]></title><description><![CDATA[In a first for this blog here is a post I worked on with Mike Aiello , a former colleague from Goldman Sachs and Google and someone, like...]]></description><link>https://www.philvenables.com/post/good-ciso---bad-ciso</link><guid isPermaLink="false">68cd7766b1109199a4030d96</guid><category><![CDATA[Cybersecurity]]></category><category><![CDATA[Leadership]]></category><pubDate>Sat, 20 Sep 2025 14:54:32 GMT</pubDate><dc:creator>Phil Venables</dc:creator></item><item><title><![CDATA[Metaphors Matter: Cyber War vs. Cyber Hygiene ]]></title><description><![CDATA[Cybersecurity is a field built on metaphor. We wage "cyber wars," build "digital fortresses," and practice "cyber hygiene." These phrases...]]></description><link>https://www.philvenables.com/post/metaphors-matter-cyber-war-vs-cyber-hygiene</link><guid isPermaLink="false">68bb2ff398886589b9fedcb3</guid><category><![CDATA[Cybersecurity]]></category><pubDate>Sat, 06 Sep 2025 14:01:49 GMT</pubDate><dc:creator>Phil Venables</dc:creator></item><item><title><![CDATA[Everyone Has A Plan Until They Get Punched In The Face]]></title><description><![CDATA[Apparently what Mike Tyson actually said in a 1987 interview was, " Everybody has plans until they get hit for the first time". In any...]]></description><link>https://www.philvenables.com/post/everyone-has-a-plan-until-they-get-punched-in-the-face</link><guid isPermaLink="false">68a494eb34b07f0731c784be</guid><category><![CDATA[Leadership]]></category><category><![CDATA[Cybersecurity]]></category><category><![CDATA[Risk]]></category><pubDate>Sat, 23 Aug 2025 15:11:42 GMT</pubDate><dc:creator>Phil Venables</dc:creator></item><item><title><![CDATA[Security and The 7 Deadly Sins]]></title><description><![CDATA[I re-stumbled across this well-worn meme of the 7 deadly sins and social media so, as many of you come back from Las Vegas I thought it...]]></description><link>https://www.philvenables.com/post/security-and-the-7-deadly-sins</link><guid isPermaLink="false">68839868eb034c7a03b5fe27</guid><category><![CDATA[Cybersecurity]]></category><pubDate>Sat, 09 Aug 2025 08:10:14 GMT</pubDate><dc:creator>Phil Venables</dc:creator></item><item><title><![CDATA[Decoding Cybercrime's True Scope: Beyond the Trillion-Dollar Hype]]></title><description><![CDATA[As security specialists, we regularly see claims about the escalating scale of cybercrime, often hearing staggering claims that it’s a...]]></description><link>https://www.philvenables.com/post/decoding-cybercrime-s-true-scope-beyond-the-trillion-dollar-hype</link><guid isPermaLink="false">688397c86ab2534c7b0248e7</guid><category><![CDATA[Cybersecurity]]></category><pubDate>Sat, 26 Jul 2025 14:46:57 GMT</pubDate><dc:creator>Phil Venables</dc:creator></item></channel></rss>