Stop Measuring Security Controls. Measure Decision Latency.

Posted on August 10, 2026 by Brent Huston

The attacker already made a decision.

Your organization is still scheduling the meeting.

For years, security programs have measured the presence and performance of controls. We count vulnerabilities, patching percentages, phishing failures, endpoint coverage, open findings, audit exceptions, and incident response times.

These metrics can be useful.

They can also create the illusion that security outcomes are primarily determined by control quality.

In many consequential events, the organization does not fail because it lacks information or technology.

It fails because it cannot make a confident decision quickly enough.

Cyberleader

Continue reading →

Security Debt Compounds Faster Than Technical Debt

Posted on August 3, 2026 by Brent Huston

Organizations rarely wake up insecure.

They slowly inherit yesterday’s exceptions.

A firewall rule is added to support an urgent launch. A service account is created for an integration that will supposedly be replaced next quarter. A vendor receives elevated access during troubleshooting. A legacy application remains connected because the migration became more difficult than expected.

Each decision appears manageable in isolation.

Over time, they begin to interact.

That is when security debt starts to compound.

Thinking

Security Debt Is More Than Unpatched Software

Technical debt generally refers to the future cost created when teams choose a faster or easier implementation today.

Continue reading →

Your Biggest Security Risk Might Be Organizational Complexity

Posted on July 31, 2026 by Brent Huston

Every security team adds tools to reduce risk.

A new endpoint platform closes a visibility gap. A cloud security product addresses configuration drift. An identity tool improves access governance. Another dashboard gives executives a consolidated view of the environment.

Individually, each decision makes sense.

Collectively, those decisions can create a security program that is difficult to understand, expensive to operate, and nearly impossible to change safely.

Eventually, the tools intended to reduce risk become part of the risk.

GenSec

Complexity Is an Attack Surface

We usually describe the attack surface in technical terms: exposed services, vulnerable applications, unmanaged devices, excessive privileges, and external dependencies.

But organizations also have an operational attack surface.

Continue reading →

Vendor Evidence Is Now a Cyber Materiality Risk

Posted on June 29, 2026 by Brent Huston

A cybersecurity incident does not care where your data lives.

It does not care that the affected application is vendor-managed. It does not care that the logs are in a SaaS console your team cannot access. It does not care that the data-flow diagram is maintained by procurement, that customer-impact details live with a managed service provider, or that the outage timeline depends on a third-party support ticket.

But your materiality decision may care very much.

Public companies must disclose material cybersecurity incidents on Form 8-K within four business days after determining that the incident is material. The SEC’s rule also requires disclosure of the material aspects of the incident’s nature, scope, timing, and impact or reasonably likely impact, and the materiality determination must be made without unreasonable delay after discovery.

That creates a practical problem many organizations have not fully internalized:

The disclosure clock may be yours, but the evidence may belong to someone else.

That is not just a legal nuance.

It is an operational design problem.

It is a governance problem.

Continue reading →

Cyber Materiality Engineering: How CISOs Pre-Decide When Risk Becomes a Board Event

Posted on May 18, 2026 by Brent Huston

A ransomware incident does not stay technical for very long.

For about the first fifteen minutes, it may look like a security operations problem. A strange alert. A locked server. A suspicious authentication chain. A vendor portal behaving badly. A handful of systems no longer responding the way they should.

Then the blast radius starts to widen.

Operations wants to know whether they can keep running. Finance wants to know whether revenue recognition, cash movement, reserves, or forecasts are exposed. Legal wants to know whether notification clocks have started. The CEO wants to know what can be said, to whom, and when. The board wants to know whether this is “material.” Investors may eventually ask the same thing, only with less patience and more lawyers.

This is where many organizations discover that their cyber incident response plan is not really an enterprise decision plan. It tells people who to call. It tells the SOC how to preserve evidence. It may even have a communications tree and a sample press statement.

But it often does not answer the question that matters most in the first few hours:

Continue reading →

Defending Small Credit Unions in the Age of AI-Driven Synthetic Fraud

Posted on February 2, 2026 by Brent Huston

We’ve seen fraud evolve before. We’ve weathered phishing, credential stuffing, card skimming, and social engineering waves—but what’s coming next makes all of that look like amateur hour. According to Experian and recent security forecasting, we’re entering a new fraud era. One where AI-driven agents operate autonomously, build convincing synthetic identities at scale, and mount adaptive, shape-shifting attacks that traditional defenses can’t keep up with.

For small credit unions and community banks, this isn’t a hypothetical future—it’s an urgent call to action.

The Rise of Synthetic Realities

Criminals are early adopters of innovation. Always have been. But now, 80% of observed autonomous AI agent use in cyberattacks is originating from criminal groups. These aren’t script kiddies with GPT wrappers—these are fully autonomous fraud agents, built to execute entire attack chains from data harvesting to cash-out, all without human intervention.

They’re using the vast stores of breached personal data to forge synthetic identities that are indistinguishable from real customers. The result? Hyper-personalized phishing, credential takeovers, and fraudulent accounts that slip through onboarding and authentication checks like ghosts.

Worse yet, quantum computing is looming. And with it, the shift from “break encryption” to “harvest now, decrypt later” is already in motion. That means data stolen today—unencrypted or encrypted with current algorithms—could be compromised retroactively within a decade or less.

So what can small institutions do? You don’t have the budget of a multinational bank, but that doesn’t mean you’re defenseless.

Three Moves Every Credit Union Must Make Now

1. Harden Identity and Access Controls—Everywhere

This isn’t just about enforcing MFA anymore. It’s about enforcing phishing-resistant MFA. That means FIDO2, passkeys, hardware tokens—methods that don’t rely on SMS or email, which are easily phished or intercepted.

Also critical: rethink your workflows around high-risk actions. Wire transfers, account takeovers, login recovery flows—all of these should have multi-layered checks that include risk scoring, device fingerprinting, and behavioral cues.

And don’t stop at customers. Internal systems used by staff and contractors are equally vulnerable. Compromising a teller or loan officer’s account could give attackers access to systems that trust them implicitly.

2. Tune Your Own Data for AI-Driven Defense

You don’t need a seven-figure fraud platform to start detecting anomalies. Use what you already have: login logs, device info, transaction patterns, location data. There are open-source and affordable ML tools that can help you baseline normal activity and alert on deviations.

But even better—don’t fight alone. Join information-sharing networks like FS-ISAC, InfraGard, or sector-specific fraud intel circles. The earlier you see a new AI phishing campaign or evolving shape-shifting malware variant, the better chance you have to stop it before it hits your members.

3. Start Your “Future Threats” Roadmap Today

You can’t wait until quantum breaks RSA to think about your crypto. Inventory your “crown jewel” data—SSNs, account histories, loan documents—and start classifying which of that needs to be protected even after it’s been stolen. Because if attackers are harvesting now to decrypt later, you’re already in the game whether you like it or not.

At the same time, tabletop exercises should evolve. No more pretending ransomware is the worst-case. Simulate a synthetic ID scam that drains multiple accounts. Roleplay a deepfake CEO fraud call to your CFO. Put AI-enabled fraud on the whiteboard and walk your board through the response.

Final Thoughts: Small Can Still Mean Resilient

Small institutions often pride themselves on their close member relationships and nimbleness. That’s a strength. You can spot strange behavior sooner. You can move faster than a big bank on policy changes. And you can build security into your culture—where it belongs.

But you must act deliberately. AI isn’t waiting, and quantum isn’t slowing down. The criminals have already adapted. It’s our turn.

Let’s not be the last to see the fraud that’s already here.

* AI tools were used as a research assistant for this content, but human moderation and writing are also included. The included images are AI-generated.

Antifragility in the Age of Cyber Extremistan

Posted on January 14, 2026 by Brent Huston

Why Building Cybersecurity Like the Human Immune System Is the Only Strategy That Survives the Unknown

Unnamed 4

We don’t live in “Mediocristan” anymore.

In the controlled world of Gaussian curves and predictable outcomes, most security strategies make sense—if you’re still living in the realm where human height and blood pressure are your biggest threats. But for cybersecurity practitioners, the real world looks more like “Extremistan”—the place where Black Swan events dominate, where a single breach can wipe out decades of effort, and where average behavior is not just irrelevant, it’s dangerously misleading.

That’s the world Nassim Taleb described in The Black Swan, and it’s the reality we live in every day as defenders of digital infrastructure.

And if you’re using traditional models to manage cyber risk in this world, you’re probably optimizing for failure.

From Robust to Antifragile: Why Survival Isn’t Enough

Taleb coined the term antifragile to describe systems that don’t just resist chaos—they improve because of it. It’s the difference between a glass that doesn’t break and a muscle that gets stronger after lifting heavy weight. Most security programs are designed to be robust—resilient under stress. But that’s not enough. Resilience still assumes a limit. Once you pass the red line, you break.

To thrive in Extremistan, we need to design systems that learn from stress, that benefit from volatility, and that get stronger every time they get punched in the face.

1. Security by Subtraction (Via Negativa)

In medicine, there’s a term called iatrogenics—harm caused by the treatment itself. Sound familiar? That’s what happens when a security stack becomes so bloated with overlapping agents, dashboards, and tools that it becomes its own attack surface.

Antifragile security starts with subtraction:

Decommission Legacy: Every unmonitored web server from 2009 you forgot about is a potential ruin event.
Minimize Privilege: If your domain admin group has more people than your bowling team, you’re in trouble.
Simplify, Aggressively: Complexity is fragility disguised as maturity.

Less isn’t just more—it’s safer.

2. Controlled Stressors: Hormesis for Systems

An immune system kept in a bubble weakens. One that’s constantly challenged becomes elite. The same goes for cyber defenses.

Red Teams as Immune Response Training: Stop treating red teams as adversaries. They’re your vaccine.
Chaos Engineering: Don’t just test recovery—induce failure. Intentionally break things. Break them often. Learn faster than your adversaries.
Study the Misses: Every alert that almost mattered is gold dust. Train on it.

This isn’t about drills. It’s about muscle memory.

3. The Barbell Strategy: Secure Boring + Wild Bets

One of Taleb’s more underappreciated ideas is the barbell strategy: extreme conservatism on one end, high-risk/high-reward exploration on the other. Nothing in the middle.

90%: Lock down the basics. IG1 controls. Patching. Backups. Privilege minimization. The boring stuff that wins wars.
10%: Invest in weird, bleeding-edge experiments. Behavioral traps. Decoy data. Offensive ML. This is your lab.

Never bet on “average” security tools. That’s how you end up with a little risk everywhere—and a big hole somewhere you didn’t expect.

4. Skin in the Game: Incentives That Matter

When the people making decisions don’t bear the cost of failure, systems rot from within.

Vendors Must Own Risk: If your EDR vendor can disclaim all liability for failure, they’ve got no skin in your game.
On-Call Developers: If they wrote the code, they stay up with it. The best SLAs are fear and pride.
Risk-Based Compensation: CISOs must have financial incentives tied to post-incident impact, not checkbox compliance.

Fragility flourishes in environments where blame is diffuse and consequences are someone else’s problem.

5. Tail Risk and the Absorbing Barrier

Most CIS frameworks are built to mitigate average risk. But in Extremistan, ruin is what you plan for. The difference? A thousand phishing attempts don’t matter if one spear phish opens the gates.

Design for Blast Radius: Assume breach. Isolate domains. Install circuit breakers in your architecture.
Plan for the Unseen: Run tabletop exercises where the scenario doesn’t exist in your IR plan. If that makes your team uncomfortable, you’re doing it right.
Offline Backups Are Sacred: If they touch the internet, they’re not a backup—they’re bait.

There are no do-overs after ruin.

6. Beware the Turkey Problem

A turkey fed every day believes the butcher loves him—until Thanksgiving. A network with zero incidents for three years might just be a turkey.

Continuous Validation, Not Annual Audits: Trust your controls as much as you test them.
Negative Empiricism: Don’t learn from the shiny success story. Learn from the company that got wrecked.

You are not safe because nothing has happened. You are safe when you have survived what should have killed you.

Closing Thought: Security as Immune System, Not Armor

If you’re still thinking of your security stack as armor—hard shell, resist all—you’re already brittle. Instead, think biology. Think immune system. Think antifragility.

Expose your system to small, survivable threats. Learn from every wound. Build muscle. Be lean, not large. Be hard to kill, not hard to touch.

In a world governed by Extremistan, the best cybersecurity strategy isn’t to avoid failure—it’s to get stronger every time you fail.

Because someday, something will break through. The question is—will you be better afterward, or gone completely?

* AI tools were used as a research assistant for this content, but human moderation and writing are also included. The included images are AI-generated.

Supply Chain Security Insights

Posted on September 2, 2022 by Brent Huston

Supply chain attacks are one of the most common cyber threats faced by organizations. They are costly and disruptive, often resulting in lost revenue and customer trust.

In this article, we’ll discuss five insights about supply chain attacks that all supply chain management and information security teams should be aware of.

#1. Supply Chains Can Be Vulnerable

Supply chains are complex networks of companies, suppliers, customers, and partners that provide goods and services to each other.

They include manufacturers, distributors, retailers, service providers, logistics providers, and others.

These entities may interact directly or indirectly via intermediaries such as banks, insurance companies, payment processors, freight forwarders, customs brokers, etc.

Supply chains are vulnerable to attack because they involve multiple parties and interactions between them. Each organization in the chain will have its own risk profile, security posture, and business model. This creates a complex environment for security risks. Attackers can target any part of the supply chain, and often focus on the weakest link, including manufacturing facilities, distribution centers, warehouses, transportation hubs, retail stores, etc.

Attackers can disrupt operations, steal intellectual property, damage reputation, and cause losses in revenue and profits.

#2. Supply Chain Security Must Include All Stakeholders

Supply chain security involves protecting against threats across the entire value stream. This means securing data, processes, systems, physical assets, personnel, and technology.

It also requires integrating security practices and technologies across the entire organization.

This includes ensuring that information sharing occurs among stakeholders, that employees understand their roles and responsibilities, and that policies and procedures are followed.

Security professionals should collaborate closely with executives, managers, and staff members to ensure that everyone understands the importance of security and has ownership over its implementation.

#3. Supply Chain Security Requires Ongoing Monitoring and Maintenance

Supply chain security requires ongoing monitoring and maintenance.

An effective approach is to continuously monitor the status of key indicators, assess risks, identify vulnerabilities, and implement countermeasures.

For example, an attacker could attempt to compromise sensitive data stored in databases, websites, mobile apps, and other locations.

To prevent these incidents, security teams should regularly review logs, audit reports, and other intelligence sources to detect suspicious activity.

They should also perform penetration tests, vulnerability scans, and other assessments to uncover potential weaknesses.

#4. Supply Chain Security Requires Collaboration Across Organizations

A single department cannot manage supply chain security within an organization.

Instead, it requires collaboration across departments and functional areas, including IT, finance, procurement, human resources, legal, marketing, sales, and others.

Each stakeholder must be responsible for maintaining security, understanding what constitutes acceptable behavior, and implementing appropriate controls.

Collaborating across organizational boundaries helps avoid silos of knowledge and expertise that can lead to gaps in security awareness and training.

#5. Supply Chain Security Is Critical to Organizational Success

Organizations that fail to protect their supply chains face significant financial penalties.

A recent study found that supply chain breaches cost United States businesses $6 trillion annually.

That’s equivalent to nearly 10% of the annual global GDP.

Supply chain attacks can result in lost revenues, damaged reputations, and increased costs.

Companies that invest in supply chain security can significantly improve operational efficiency, productivity, profitability, and brand image.

Three Things I’ve Learned About Credit Union Risk Management

Posted on August 10, 2020 by Brent Huston

I have been working with Credit Unions for more than 20 years and have done a wide variety of information security and risk management work over that time. I’ve worked with technical teams, management and boards over the span of more than two decades. Here are three things I’ve learned about how CUs manage risk during that time.

1) Most credit unions that I’ve worked with care just as much, if not more, about information security than most of the regional size banks they often compete with.

I’ve heard more than one CU leader tell me that they have to be better than the banks, because when a bank gets hacked – that bank makes the news and feels the impact. However, he said, when a credit union gets hacked – all credit unions suffer from the bad press. I am not sure the data supports his claim, but it’s an example of how CUs often focus on working together to solve big problems, and put a lot more attention to detail into it.

2) Many of the credit unions I have worked with look at information security and threat awareness as something that they can offer to their members (“customers, in bank speak”).

More than a few of the CUs have engaged so deeply with their customers on phishing and identify theft, that they include them in discussions about what products and services the CU buys. They do trials, include members in beta-tests and I’ve even seen them do onsite training for how to use new multi-factor authentication tools – even ones that weren’t in use at the CU – just to help make the members more secure and reduce the threat of password re-use across personal sites.

3) The board is often more involved in the risk management process at my CU clients than my banking clients.

The NCUA has taken a lot of steps to increase board member awareness about information security, and it often shows at credit unions. Several times a year, I am asked to present threat updates or review the information security program of a CU, specifically with a presentation to the board in mind. I am often engaged as a third party, to spend a couple of days looking at a security program and reporting to the board on it’s maturity and areas of potential improvement.

During these board sessions, it is not uncommon for the board questions to last more than an hour, after the presentation has completed. The point is, most CU boards that I have worked with are deeply engaged in thinking about risk management at the credit union.

For those of you interested in more about risk management at credit unions, here are some of the best sources, which I refer to often in my presentations:

Credit unions also face such internal risks as internal fraud, legal and regulatory noncompliance, data breaches, and injuries to staff and visitors. (boardeffect.com)
The bottom line: Figuring out the risk appetite will help guide credit unions to create realistic and measurable risk guidelines. (visibleequity.com)
We have helped Credit Unions develop risk appetite statements and risk frameworks and can work with your Credit Union to develop the documentation you require. (creditunionupdate.com)

If you’d like to learn more about MSI and our work with credit unions, just drop us a line (info@microsolved.com) or give us a call (614-351-1237) and we’d be happy to talk about how we might be able to help your credit union excel in IT risk management.

A Quick Expert Conversation About Gap Assessment

Posted on January 8, 2020 by Brent Huston

Gap Assessment Interview with John Davis

What follows is a quick interview session with John Davis, who leads the risk assessment/policy/process team at MicroSolved. We completed the interview in January of 2020, and below are the relevant parts of our conversation.

Brent Huston: “Thanks for joining me today, John. Let’s start with what a gap assessment is in terms of HIPAA or other regulatory guidance.”

John Davis: “Thanks for the chance to talk about gap assessment. I have run into several HIPAA concerns such as hospitals and health systems who do HIPAA gap analysis / gap assessment in lieu of HIPAA risk assessment. Admittedly, gap assessment is the bulk of risk assessment, however, a gap assessment does not go to the point of assigning a risk rating to the gaps found. It also doesn’t go to the extent of addressing other risks to PHI that aren’t covered in HIPAA/HITECH guidance.”

BH: “So, in some ways, the gap assessment is more of an exploratory exercise – certainly providing guidance on existing gaps, but faster and more affordable than a full risk assessment? Like the 80/20 approach to a risk assessment?”

John Davis: “I suppose so, yes. The price is likely less than a full blown risk assessment, given that there is less analysis and reporting work for the assessment team. It’s also a bit faster of an engagement, since the deep details of performing risk analysis aren’t a part of it.”

BH: “Should folks interested in a gap assessment consider adding any technical components to the work plan? Does that combination ever occur?”

JD: “I can envision a gap assessment that also includes vulnerability assessment of their networks / applications. Don’t get me wrong, I think there is immense value in this approach. I think that to be more effective, you can always add a vulnerability assessment to gauge how well the policies and processes they have in place are working in the context of the day-to-day real-world operations.”

BH: “Can you tie this back up with what a full risk assessment contains, in addition to the gap assessment portion of the work plan?”

JD: “Sure! Real risk assessment includes controls and vulnerability analysis as regular parts of the engagement. But more than that, a complete risk assessment also examines threats and possibilities of occurrence. So, in addition to the statement of the gaps and a roadmap for improvement, you also get a much more significant and accurate view of the data you need to prioritize and scope many of the changes and control improvements needed. In my mind, it also gets you a much greater view of potential issues and threats against PHI than what may be directly referenced in the guidance.”

BH: “Thanks for clarifying that, John. As always, we appreciate your expert insights and experience.”

JD: “Anytime, always happy to help.”

If you’d like to learn more about a gap assessment, vulnerability assessment or a full blown risk assessment against HIPAA, HITECH or any other regulatory guidance or framework, please just give us a call at (614) 351-1237 or you can click here to contact us via a webform. We look forward to hearing from you. Get in touch today!