https://cisoexpert.com/ Cybersecurity leadership, strategy, and the human side of information security. en https://cisoexpert.com/blog/your-decisions-are-the-bottleneck https://cisoexpert.com/blog/your-decisions-are-the-bottleneck AI can do security work in seconds, but the work still waits in queues and SLAs built for human speed. Compare each SLA with how fast AI can do the same step, automate the steps that need no judgment, and set clear rules for when containment blocks and when it goes to a person. Sun, 27 Sep 2026 00:00:00 GMT https://cisoexpert.com/blog/how-to-talk-like-a-ciso-the-language-of-business https://cisoexpert.com/blog/how-to-talk-like-a-ciso-the-language-of-business Security leaders lose decisions when they report on controls instead of choices. A question-stage note: why I think the translation fails, what the SEC's 2023 rule implies about who carries it, and a way to start practising this week. Sun, 27 Sep 2026 00:00:00 GMT https://cisoexpert.com/frameworks/mountain-maturity https://cisoexpert.com/frameworks/mountain-maturity A mountain-climbing analogy that translates NIST CSF maturity levels into a five-stage narrative — Basecamp through Summit Standard — that boards and executives grasp without a framework briefing. Mon, 21 Sep 2026 18:00:00 GMT https://cisoexpert.com/blog/mcp-annotation-gap-ecosystem-analysis https://cisoexpert.com/blog/mcp-annotation-gap-ecosystem-analysis On 2026-05-21 I scanned 16 public MCP servers for tool annotations, the hints agent clients use to decide when a human approves an action. The scanner flagged all 16, and one of those results is wrong. Here is what the gap means for approval gates, and what to check before you adopt a server. Thu, 21 May 2026 00:00:00 GMT https://cisoexpert.com/blog/2026-04-27-what-ai-should-shouldnt-do-in-your-soc https://cisoexpert.com/blog/2026-04-27-what-ai-should-shouldnt-do-in-your-soc Only 9% of security practitioners are "very confident" in AI-generated alerts — yet adoption is accelerating. The gap comes down to a distinction the demos never make: AI at decision points in a workflow is not the same as AI replacing the workflow. Here is which use cases earn their keep. Mon, 27 Apr 2026 19:00:00 GMT https://cisoexpert.com/blog/2026-04-09-data-lake-searchability-architecture https://cisoexpert.com/blog/2026-04-09-data-lake-searchability-architecture You moved security data to a lake and cut costs. Then an investigation hit and your team spent two weeks finding what should have taken hours. The difference between a cheap archive and a queryable security asset comes down to three architecture decisions most organizations haven't made yet. Thu, 09 Apr 2026 19:00:00 GMT https://cisoexpert.com/tools/claude-prompt-timer https://cisoexpert.com/tools/claude-prompt-timer Claude Code can't tell whether you left for two minutes or eight hours, so it picks up stale threads as if nothing changed. claude-prompt-timer is a small hook that tells it how long you've been away. Install it in three steps and confirm it works in one. Thu, 09 Apr 2026 00:00:00 GMT https://cisoexpert.com/blog/2026-04-01-siem-cost-trap-data-lake-ai-agents https://cisoexpert.com/blog/2026-04-01-siem-cost-trap-data-lake-ai-agents The per-gigabyte SIEM pricing model punishes growth. A tiered architecture — hot data for detection, cold storage in a data lake, AI agents bridging the gap — breaks the cost trap without sacrificing security outcomes. Here's how to make the case to your leadership. Wed, 01 Apr 2026 19:00:00 GMT https://cisoexpert.com/blog/2026-03-22-ai-pen-testing-rsa2026 https://cisoexpert.com/blog/2026-03-22-ai-pen-testing-rsa2026 Security testing has always been an economics problem: defenders can only test what they can afford to test. AI changed the cost of testing, and that changes which assumptions about coverage still hold. Sun, 22 Mar 2026 19:00:00 GMT https://cisoexpert.com/blog/2026-03-18-four-generations-broken-promises https://cisoexpert.com/blog/2026-03-18-four-generations-broken-promises Three generations of security tooling promised to fix the analyst shortage. All three failed. The fourth — AI SOC Agents — operates on a different principle, but CISOs who ignore twenty years of lessons will repeat the same expensive mistakes. Wed, 18 Mar 2026 19:00:00 GMT https://cisoexpert.com/blog/2026-03-17-glassworm-invisible-unicode-ai-code-scanner https://cisoexpert.com/blog/2026-03-17-glassworm-invisible-unicode-ai-code-scanner GlassWorm hid malicious code in invisible Unicode characters. I scanned 152 files of my own AI-generated code to see whether the same trick was already sitting in my repositories — and built a pre-commit check from what I found. Tue, 17 Mar 2026 19:00:00 GMT https://cisoexpert.com/blog/2026-03-04-the-claude-code-cves-hit-close-to-home https://cisoexpert.com/blog/2026-03-04-the-claude-code-cves-hit-close-to-home Check Point disclosed two Claude Code CVEs exploiting hooks and MCP config files. Here's what the attack chains look like and how to harden your environment. Wed, 04 Mar 2026 19:00:00 GMT https://cisoexpert.com/blog/how-i-made-claude-code-safer-and-you-can-too https://cisoexpert.com/blog/how-i-made-claude-code-safer-and-you-can-too Claude Code validates which tools can run, not what they write. That gap cost me a crashed project and a malformed config file — so I built a plugin that validates content before it hits disk, and it turned out to teach Claude to stop repeating the same mistakes. Tue, 10 Feb 2026 19:00:00 GMT https://cisoexpert.com/tools/document-guard https://cisoexpert.com/tools/document-guard An open-source Claude Code plugin that inspects every file edit before it hits disk — catching credential leaks, silently dropped Markdown sections, and broken configs that permission rules alone don't stop. Tue, 10 Feb 2026 00:00:00 GMT https://cisoexpert.com/blog/i-ran-849-tests-on-ai-context-files-heres-what-actually-works https://cisoexpert.com/blog/i-ran-849-tests-on-ai-context-files-heres-what-actually-works 849 controlled tests across three corpus sizes and five folder structures found that a single flat folder with descriptive filenames beats nested hierarchies at every scale — and that keyword or summary indexes actively hurt accuracy once a corpus passes 300K words. Thu, 05 Feb 2026 19:00:00 GMT https://cisoexpert.com/blog/how-i-made-claude-code-10-30x-faster-with-pre-selection-hooks https://cisoexpert.com/blog/how-i-made-claude-code-10-30x-faster-with-pre-selection-hooks Guidance that arrives before a decision beats guidance buried in instructions. By intercepting tool choices before they happen, I cut code-navigation searches from ~300ms to ~50ms — a 10-30x improvement that compounds across hundreds of searches a day. Wed, 04 Feb 2026 19:00:00 GMT https://cisoexpert.com/blog/4-essentials-for-executive-business-buyin-on-your-incident-response-plan https://cisoexpert.com/blog/4-essentials-for-executive-business-buyin-on-your-incident-response-plan Four things an incident response plan needs before executives will stand behind it: response SLAs the business agrees to, a clear split between operational and strategic plans, formalization of processes you already run rather than net-new invention, and a signature from the C-suite. Fri, 23 Dec 2022 05:51:26 GMT https://cisoexpert.com/blog/the-cybersecurity-evolving-threats https://cisoexpert.com/blog/the-cybersecurity-evolving-threats A general-audience tour of the threats that dominated 2022 — ransomware, malware, and phishing — and the baseline controls that reduce exposure to them. Fri, 23 Dec 2022 05:15:36 GMT https://cisoexpert.com/blog/top-5-things-for-a-successful-cyber-response-ir-plan https://cisoexpert.com/blog/top-5-things-for-a-successful-cyber-response-ir-plan Having an incident response plan at all is associated with a 43% reduction in breach cost. Here are the five things that separate a plan that holds up under pressure from one that sits unread — with practical examples for each. Wed, 12 Jan 2022 01:02:00 GMT