Get CWS Insights in your inbox.
Channel strategy, services delivery patterns, and AI security operations. Roughly monthly, never spammy.
SubscribeInsights
What we're learning about channel cybersecurity delivery.
Field notes from the CWS team on services productization, channel strategy, AI security, and what's actually working with partners and their customers.
Featured
Service Delivery
August 14, 20266 min readCWS
Your Application Security Budget Was Set Before Anyone Counted the Repositories
An application portfolio counts what the business funds. An application security program is staffed against where the code lives. What an estate inventory records, how a top tier you can defend falls out of it, and what to write down before you commit to a number.
Read articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleSecurity LeadershipRead articleService DeliveryRead articleService DeliveryRead articleIndustry InsightsRead articleIndustry InsightsRead articleIndustry InsightsRead articleService DeliveryRead articleService DeliveryRead articleIndustry InsightsRead articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleSecurity LeadershipRead articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleIndustry InsightsRead articleService DeliveryRead articleIndustry InsightsRead articleService DeliveryRead articleSecurity LeadershipRead articleService DeliveryRead articleService DeliveryRead articleIndustry InsightsRead articleIndustry InsightsRead articleService DeliveryRead articleService DeliveryRead articleIndustry InsightsRead articleService DeliveryRead articleIndustry InsightsRead articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleService DeliveryRead articleIndustry InsightsRead articleService DeliveryRead articleNewsletter
You Cannot Govern the AI You Have Not Found Yet
The ask is a tool. The problem is inventory. What shadow AI discovery surfaces, and why discovery, baseline and policy come before tool selection. SAIL 2.0 as the spine, with NIST AI RMF, ISO 42001 and the EU AI Act mapped alongside.
August 14, 20266 min readCWS
Three Clouds, Three Severity Scales, One Board Asking for One Number
Three consoles grading on three scales, with the reconciliation left to the final week. Why the rubric is the deliverable and the tool is an evidence source, and what implementing the platforms changes about assessing with them.
August 14, 20266 min readCWS
Go-Live Was the Milestone. Now Comes the Part That Decides Whether It Worked.
Written for the security leader who signed off cutover and is now being asked what it delivered. The four categories of work that arrive after go-live, the order to take them in, and the operating model that has to exist around the platform.
August 14, 20265 min readCWS
Your DSPM Scan Finished Six Months Ago. Nothing Has Changed.
Across three engagements the failure point sat in the operating model rather than the connector. Owners, labels, exceptions and cadence, and the quarterly cycle that makes posture actually improve.
August 14, 20265 min readCWS
The Board Has Your Application Count. Source Control Returns a Different Number.
An application is a business abstraction and a repository is an artifact of how teams work, so the two counts answer different questions. The reconciliation between them is the deliverable, and it has to exist before the conversation does.
August 14, 20266 min readCWS
You Have Already Tiered the Estate. Write Down the Basis Before Somebody Asks.
Which tiering criteria survived a sort across roughly 6,300 repositories and which failed on contact with the volume, plus what the three people who will challenge your tiers are actually asking.
August 14, 20266 min readCWS
The Scanner Reports 100 Percent Coverage. Coverage of What?
A coverage percentage is computed against the scope the tool was given, and it answers that question exactly. Building the denominator independently belongs to whoever owns the estate.
August 14, 20268 min readCWS
The Acquisition Closed. The Repositories Are Yours Now.
Due diligence answered whether the code was owned cleanly and licensed properly. Three questions came with the signature: how many places that code lives, who still has access to them, and what shipped to production the week before. A first-thirty-days sequence.
August 14, 20267 min readCWS
AWS Grades AWS. Azure Grades Azure. The Order Is Yours to Write.
Aggregating three clouds into one view is a product capability. The method that ranks the combined list, the business inputs behind it and the name against each judgment get built inside your organization.
August 14, 20267 min readCWS
The Same Control Passes in One Cloud and Fails in Another. Both Are Right.
One control intent, three provider models, three honest answers that disagree. Where the drift concentrates, what each framework carries, and the one answer you still owe whoever asked.
August 14, 20266 min readCWS
The Console Says Critical. Critical to What Is Your Sentence to Write.
A severity rating describes the finding. The weight on it depends on what the workload does and what the business would notice if it stopped, which is the environmental judgment CVSS leaves to the asset owner.
August 14, 20267 min readCWS
The AI Policy Says Ask First. The Logs Say Nobody Asks.
The policy is being routed around, because the approval path runs slower than the work it approves. Closing that gap means making the sanctioned route the faster one.
August 14, 20267 min readCWS
Four AI Frameworks Landed on Your Desk. They Are Not Competing.
SAIL 2.0, the NIST AI Risk Management Framework, ISO/IEC 42001 and the EU AI Act answer different questions at different layers. Which one anchors the program and what the others contribute.
August 14, 20268 min readCWS
The AI Agent Went to Production With More Access Than Any New Hire
An agent is an identity, and you already run joiner-mover-leaver, access review and service-account hygiene. What those disciplines need adjusted before they cover something that never files a ticket.
August 14, 20267 min readCWS
The Chatbot Answers From Documents Nobody Checked It Could Read
The assistant honors the permission model exactly as designed. What changed is that finding a document no longer requires knowing it exists, so a decade of inherited sharing became queryable in one sentence.
August 14, 20266 min readCWS
Vendor Detection Content Covers What Every Company Has. Your Estate Has More.
Vendor content is built to generalize across every customer, which is exactly what it is for. The internal application three teams depend on and the service account created in 2018 are the operator's layer to build.
August 14, 20267 min readCWS
The Source Count Went Up. The Detection Count Runs on a Different Clock.
Onboarding a log source has a definition of done and writing the detection that reads it is a judgment call, so ingestion runs ahead and the source count gets reported upward as progress. Ordering sources by the detections that will consume them.
August 14, 20267 min readCWS
Copilot Will Answer With Anything the Permissions Let It See
The assistant returns only what the requesting user could already open, which is the right design. What changed is that retrieving it no longer takes effort, and a decade of sharing decisions never expired.
August 14, 20266 min readCWS
The Labels Were Designed in a Workshop. The Data Was Not Consulted.
The taxonomy is a hypothesis about the estate until classification runs. What the first run reports back, how to read a sparse or overloaded tier before editing it, and which side gives way.
August 14, 20266 min readCWS
The Finding Is Critical and the Repository Has No Owner
Remediation routing assumes somebody will answer. Reconstructing ownership by evidence when the team reorganized, the contractor org outlived its project and CODEOWNERS names people who left.
August 14, 20267 min readCWS
You Will Not Fix All of It. Choose What You Fix First.
The backlog exceeds any plausible team, permanently. You are choosing an order and living with what stays open, so the order needs a basis you can defend when something you deprioritized is what gets exploited.
August 14, 20267 min readCWS
No Commits in Two Years, and the Repository Still Ships Risk
The commit date describes the source. The exposure sits in what that source produced and where the output ended up. Four records that answer what the commit history leaves open, and why a dormant repository may be the only surviving description of something still running.
August 14, 20267 min readCWS
The Credential Has Been in the Repo History for Years
It was removed in a later commit, so it looks gone. Anyone with clone access has it. Rotate first, because rewriting history while the credential still works protects nothing.
August 14, 20267 min readCWS
The SIEM Was Replaced. The Way the Team Works Was Not.
The migration plan covered data, content and cutover. It did not cover queue discipline, escalation or shift handover, because that was nobody's line item.
August 14, 20266 min readCWS
Mean Time to Remediate Improved Because the Counting Changed
Nobody falsified anything. Findings deduplicated differently, a repository set narrowed, the clock started at triage. Unmanaged metrics drift in the flattering direction by default.
August 14, 20267 min readCWS
The Scope List Is Assembled by People. The Billing Hierarchy Is Maintained by Machinery.
Three independent enumerations of your cloud accounts already exist inside the organization. The scope list a posture assessment runs against is built from a fourth source: whoever was in the room.
August 14, 20266 min readCWS
Every Data Store Has an Owner. The Column Is Full of Distribution Lists.
The field is populated so the register looks complete. An alias cannot accept a risk or approve a deletion, and the platform team who administer the storage account are custodians rather than owners.
August 14, 20266 min readCWS
The Security Gate Is in the Pipeline. The Releases Go Around It.
A hotfix at 2am, a legacy service that could not run the scanner, a second pipeline for a deployment the first could not handle. A small number of visible, owned, expiring exceptions beats a claim of zero.
August 14, 20267 min readCWS
Every Exception Was Temporary. Read the Dates on Them.
Expiry required someone to notice, chase an owner and take something away. The accumulated exception set is now the real control environment, while the audit reads the policy.
August 14, 20267 min readCWS
A Penetration Test Scoped From the Org Chart Tests the Org Chart
Every team answers accurately about what it knows. Claimed and maintained turn out to be nearly the same population, and the systems nobody claims never enter the scope.
August 14, 20267 min readCWS
The Playbook Library Is Full. The Automation Rate Has Not Moved.
They work when they run, and an approval gate that goes quiet at six in the evening decides how much they run. Adoption is a trust ladder, and moving a playbook up it from advisory to enforcing needs an owner.
August 14, 20266 min readCWS
The DLP Policy Has Been in Audit Mode for a Year
Deploying in audit mode was correct. Staying there is institutionalized indecision, and getting out needs a first enforcement narrow enough that the blast radius is known and cover arranged in advance.
August 14, 20266 min readCWS
The Second Cloud Arrived With an Acquisition. The Guidance Assumes a Strategy.
Every piece of multi-cloud guidance assumes a deliberate strategy, and yours arrived through a transaction. Converging the estate is optional: standardize identity, logging and the baseline, and leave the rest different on purpose.
August 14, 20266 min readCWS
The Finding Is in GCP. The Fix Is in Terraform. The Owner Is in Neither.
A fix applied in the console has a countdown on it. Mapping a resource back to the module that produced it, and why closure measured at the console produces console fixes.
August 14, 20266 min readCWS
The AI Feature Arrived in a Vendor Update, Below the Procurement Gate
Your intake gate fires on purchase. The thing that needs review is a capability change in software already in the estate, and nothing was procured for procurement to notice.
August 14, 20266 min readCWS
The AI Governance Committee Has Met Six Times and Shipped Nothing
Attendance is good and minutes are taken. A body chartered to advise rather than decide produces advice, and advice has no throughput. Measure decisions per meeting and how long an item sits.
August 14, 20266 min readCWS
Six Months After Cutover, Nobody Can Say What Improved
Baselining was nobody's task, because the migration was scoped as a technical delivery. What to capture before a cutover, and how to reconstruct a defensible partial baseline once the moment has passed.
August 14, 20266 min readCWS
Nobody Has Opened That Share Since 2019. It Is Still Your Problem.
The last-accessed date measures attention. The content is still regulated and still reachable by everyone the old permissions allow. Disposition is a records discipline security teams inherit without the matching authority, and the deletion waits on a signature.
August 14, 20266 min readCWS
The Old SIEM Still Runs Because Nobody Signed Off the Last Few Use Cases
Dual running is an ordinary migration state. It turns into a problem the day it stops having an end date, and the tail does not close through project management because every item needs somebody to accept something.
August 14, 20266 min readCWS
Decide What the Management System Covers Before You Commit to ISO 42001
Scope gets decided by whoever had the calendar time to fill in the application, rather than by whoever will defend it. The scope statement is the sentence a reviewer actually reads, and it determines what the certificate is worth.
August 14, 20266 min readCWS
You Deploy AI. You Do Not Build It. The Obligations Still Reach You.
Obligations attach by the role an organization occupies, and one organization can hold different roles for different systems. Counsel cannot answer whether you are in scope without an inventory nobody has built.
August 14, 20266 min readCWS
The Benchmark Score Went Up. The Exposure Did Not Go Down.
Benchmarks weight recommendations alike by design, so a hundred cheap corrections move the number further than the one architectural problem that matters. Publish two numbers.
August 14, 20266 min readCWS
The First Ninety Days of Alert Data Decide the Next Three Years
The early alert stream is a diagnostic nobody reads as one. A suppression written in week three holds until someone retires it, and nobody is scheduled to.
August 14, 20266 min readCWS
The Access Request Gives You One Month. The Data Map Was Signed Off Years Ago.
A statutory clock is a poor moment to discover the map is stale. Tie maintenance to the events that move the estate, and rehearse a subject retrieval before somebody makes you run one.
August 14, 20266 min readCWS
Three IAM Models, and One Engineer With Standing Access to All of Them
Each review passes because each is scoped to one estate. Privilege is held by a person, so the review is scoped to the wrong object, and deprovisioning fires on departure while the common event is an internal transfer.
August 14, 20266 min readCWS
Banning the Chatbot Created Twelve Copies of It
A block is a legitimate holding action. Left as the whole strategy it converts a governance problem into a discovery problem, and the copy you closed was the one with an agreement, an admin and a log.
August 14, 20266 min readCWS
The Platform Automates the Triage. Someone Still Owns the Verdict.
Automation moves the decision to whoever configured the rule. A wrong close stays quiet, so sampling automated closes is the mechanism, and the name goes on the page before somebody asks for it.
August 14, 20266 min readCWS
The DSPM Findings Land in a Queue No Business Unit Reads
The finding did not fail to arrive. It arrived somewhere nobody looks, phrased in a vocabulary its reader has to translate before they can act. Both are routing failures.
August 14, 20266 min readCWS
The Model Evaluation Covers the Model. Your Team Built the Application Around It.
A model can behave well and the application around it still hand somebody something they should not have. Where the line between the two scopes goes, and the questions in neither.
August 14, 20266 min readCWS
The Cloud Assessment Was Accurate in March. It Is October.
The report was correct on the day it was written and says nothing about how fast it decays. An assessment should state its own shelf life and name what would invalidate it.
August 14, 20266 min readCWS
The Residency Commitment Was Signed Before Anyone Mapped the Workloads
The commitment gets made by people reading a region selector. Residency is a property of the whole data path, including backups, telemetry, control planes and support access.
August 14, 20266 min readCWS
The Board Wants AI in the SOC. Start With the Queue Nobody Wants.
Pick the first use case by how cheaply you can tell whether it worked. A queue with a checkable answer produces evidence; a prestigious one with no ground truth produces an argument.
August 14, 20266 min readCWS