Latest Articles

Why 61% of Organizations Plan to Expand AI Protections in the Next 12 Months The Security Architecture Shift Security architecture was once about preventing incidents. The focus was on keeping threats out. The modern view is different: security architecture is as much about incident response as it is about prevention. The question isn't just "How do we keep threats out?" It's "How do we respond effectively when threats get in?" This shift applies even more to AI incidents. With AI, there may not be a "threat" to keep out—the incident may be entirely internal. This makes incident response readiness even more critical. The AI Protection Landscape The Protection Gap Dimension Current State Future State AI assistants 87% deployed beyond pilot Expanding AI controls 52% confident in detection Need improvement AI incident readiness 33% confident in investigation Need improvement AI protection expansion 61% planning expansion Expanding Over the next 12 months, 61% of organizations plan to expand AI protections. Building AI Protections into Security Architecture 1. Identity and Access Management for AI Capability Purpose Unique AI identities Accountability for AI actions Least privilege for AI Limit blast radius Access reviews for AI Regular permission validation Lifecycle management for AI Provision and revoke AI access 2. AI Behavior Monitoring Capability Purpose Real-time AI monitoring Detect AI incidents Anomaly detection for AI Identify unusual AI behavior Audit logging for AI Investigate AI incidents Kill switches for AI Stop AI incidents immediately 3. AI Incident Response Capability Purpose AI incident playbooks Structured AI incident response AI incident roles Accountable AI incident response AI incident training Prepared AI incident responders AI incident communication Effective AI incident communication 4. AI Governance Capability Purpose AI risk assessment Understand AI risks AI compliance monitoring Ensure AI compliance AI incident reporting Report AI incidents to regulators AI governance board Oversee AI governance The Security Architecture Framework Prevention Layer Access controls Least privilege Input validation Detection Layer AI behavior monitoring Anomaly detection Audit logging Response Layer AI incident playbooks AI incident roles Kill switches Recovery Layer AI incident remediation AI incident learning AI governance improvements Governance Layer AI risk assessment AI compliance monitoring AI incident reporting The Role of a Unified Platform A majority believe a unified platform is more effective than point solutions. This applies to security architecture: a unified platform provides: Single view: All protections visible in one place Correlated detection: AI incidents detected across layers Coordinated response: Consistent incident response across layers Shared learning: Learnings applied across the organization The Protection Expansion Roadmap Phase 1: Assessment Assess current AI protections Identify gaps Prioritize investments Phase 2: Foundation Implement identity for AI Implement least privilege for AI Implement monitoring for AI Phase 3: Response Create AI incident playbooks Build AI incident response capabilities Train teams on AI incident response Phase 4: Governance Establish AI governance Implement AI compliance monitoring Build AI incident reporting Conclusion: The Protection Expansion Imperative The expansion of AI protections isn't optional—it's an imperative. As AI adoption grows, the need for protections grows. Organizations that invest in AI protections—identity, monitoring, incident response, and governance—will be resilient. 61% of organizations are planning to expand AI protections. Will you be one of them? Action Items for Your Organization Assess AI protections: What do you have? What's missing? Prioritize gaps: What gaps are most critical? Build identity for AI: Unique identities, least privilege, access reviews Build monitoring for AI: Real-time monitoring, anomaly detection, audit logging Build incident response for AI: Playbooks, roles, training Build governance for AI: Risk assessment, compliance monitoring, incident reporting  

Headline: AI Agents Don't Just Monitor Controls — They Remediate Them Automatically The Evolution of Controls Automation Controls automation has evolved through several stages: Stage Description Capability Stage 1: Manual Controls are executed and tested manually Spreadsheets, screenshots, manual reviews Stage 2: Automated Monitoring Controls are monitored automatically Real-time monitoring, automated evidence collection Stage 3: AI-Augmented AI assists in analysis and decision-making Pattern detection, anomaly identification Stage 4: Agentic AI AI autonomously executes remediation Self-healing controls, autonomous remediation What Is Agentic AI for Controls? Agentic AI in controls management refers to systems that can independently plan and execute multi-step workflows to monitor, assess, and remediate controls. Key capabilities: Autonomous evidence collection: Continuously gather and validate evidence for audits  Automated control assessment: Assess control effectiveness in real time Automatic remediation: When control failures are detected, initiate remediation workflows Self-healing controls: Controls that automatically correct themselves when they fail How Agentic AI Works in Practice Example: Automated Vulnerability Remediation A federal agency automated the monitoring of control RA-05d: "Determine if legitimate vulnerabilities are remediated within an organizationally defined time frame" . The manual process: Security team runs vulnerability scans Team manually identifies overdue vulnerabilities Team creates reports Team updates control status The automated process: System continuously scans for vulnerabilities AI detects overdue vulnerabilities System automatically updates control status to "failed" Alerts notify the security team When vulnerabilities are remediated, system updates status to "passed" Evidence is collected automatically The result: A living compliance cycle that continuously monitors and adapts to current system conditions . The Agentic AI Ecosystem The architecture involves a network of specialized agents: Perception Agents: Scan for control failures and anomalies Reasoning Agents: Analyze and interpret control data Action Agents: Execute remediation workflows Learning Agents: Adapt and improve over time The Benefits Benefit Impact Reduced manual effort Automation eliminates manual checks Faster remediation Issues are fixed immediately, not at next audit Improved accuracy Consistent, auditable processes Always audit-ready Continuous evidence collection Better security posture Gaps are fixed immediately Real-world impact: Organizations can automate over 50% of yearly assessed controls, providing stakeholders with a more efficient and continuous assessment strategy . The Governance Imperative Agentic AI introduces new governance requirements: Who is accountable for AI decisions? Human oversight is still required How do we ensure ethical use? AI must operate within defined boundaries What are the kill switches? We need to stop AI if something goes wrong Conclusion Agentic AI is transforming controls management from manual, reactive processes to autonomous, self-healing systems. Organizations that embrace agentic AI for controls automation will reduce manual effort, improve accuracy, and achieve continuous compliance. Action Items for Your Organization Identify controls suitable for agentic AI automation Start with a pilot for a single control Establish governance for AI agent autonomy Define human-in-the-loop requirements Measure the reduction in manual effort Scale gradually based on success    

The Single Most Counterintuitive Rule of Modern Incident Response The Greatest Asset Becomes the Greatest Liability You have a P1 incident. The system is down. Customers are screaming. Revenue is being lost. Your instinct is obvious: get your best engineer on the problem. They know the system inside out. They've saved the day before. They can fix this. But your best engineer is also your worst enemy right now. The Incident Commander model contains the single most counterintuitive rule of modern incident response: the Incident Commander does not touch the keyboard. Why the Best Engineer Shouldn't Be in the Driver's Seat When your best engineer starts debugging: They lose oversight: They become focused on a single issue, missing the bigger picture They stop coordinating: The team loses its leader They stop communicating: Stakeholders don't know what's happening They become a bottleneck: Everyone waits for their findings They burn out: They're doing two jobs—technical leadership and technical execution The moment the Incident Commander starts debugging code, they lose oversight, and that's when things cascade. The Four Key Incident Response Roles Role 1: Incident Commander Dimension Description Responsibility Owns the response, makes decisions, keeps the team focused Action Asks sharp questions, sets priorities, delegates tasks, keeps the timeline moving Prohibited Does NOT touch the keyboard Skills Decision-making, communication, delegation, situational awareness Role 2: Technical Lead / Operations Lead Dimension Description Responsibility Investigates root cause, proposes and executes fixes Action Leads technical investigation, implements fixes Skills Deep technical expertise, problem-solving Role 3: Communications Lead Dimension Description Responsibility Updates internal stakeholders and status page Action Manages internal and external communications Skills Communication, clarity, calm under pressure Role 4: Scribe Dimension Description Responsibility Captures timeline, key decisions, and actions taken Action Documents everything in real-time Skills Attention to detail, documentation The Five-Stage Incident Response Lifecycle Many SRE teams have evolved beyond NIST's four-phase framework to a five-stage model: Prepare: Build systems, runbooks, and teams before incidents happen Detect: Identify that an incident is occurring Respond: Mobilize and coordinate the response Recover: Restore service and verify resolution Learn: Conduct blameless postmortems and improve The Incident Commander is critical in the Respond and Recover stages. The Incident Commander's Responsibilities During an incident, the Incident Commander: Starts the Response Opens an incident channel Assigns roles Sets the initial priorities Coordinates the Response Delegates tasks Manages resources Keeps the team focused Communicates Updates stakeholders Manages external communications Keeps the status page current Makes Decisions Makes decisions when the team is uncertain Sets priorities Escalates when necessary Closes the Incident Verifies service is restored Captures the timeline Schedules the postmortem The "First Five Moves" for Incident Mitigation When an incident strikes, the Incident Commander should execute the "first five moves": Open an incident channel Assign roles (IC, Ops Lead, Comms Lead, Scribe) Pin the incident doc (where all information will be captured) Declare the severity (P1, P2, etc.) Start communicating (stakeholders, status page) Building Incident Command Capabilities 1. Define Roles Clearly Document exactly what each role does during an incident. Include: Responsibilities Actions Escalation paths 2. Train Your Team Conduct regular training on incident command: Role-playing Tabletop exercises Live incident observation 3. Use Runbooks Pre-approved playbooks for common incident types: Roll back changes Flip feature flags Fail over to backup systems 4. Conduct Postmortems Blameless postmortems within 5 business days: What happened Why it happened What we'll do differently The Culture Shift The Incident Commander model requires a culture shift: From Hero Culture to System Culture Dimension Hero Culture System Culture Who's responsible Individuals Systems What's celebrated Heroic fixes Effective processes Response Individual heroics Coordinated team response Postmortem Blame Learning From Blame to Learning Blameless postmortems are the foundation of incident mastery: Focus on what failed in the system, not who caused it Turn findings into action items Schedule postmortems within 5 business days Conclusion: The Best Engineer Leads, Doesn't Execute The Incident Commander model is counterintuitive: the best engineer shouldn't touch the keyboard. But it's also effective: coordinated response beats individual heroics every time. Your best engineer's greatest value during an incident isn't their keyboard skills. It's their judgment, their decision-making, and their ability to lead. Action Items for Your Organization Define incident roles: Document Incident Commander, Technical Lead, Comms Lead, Scribe Train your team: Conduct regular incident command training Build runbooks: Create pre-approved playbooks for common incident types Conduct tabletop exercises: Practice incident response Establish blameless postmortems: Focus on learning, not blame Document everything: Capture incident timelines, decisions, and actions  

Headline: Stop Reviewing Technical Details Alone — Every Change Should Start with Business Impact The Context Problem One common failing in change management is that the CAB lacks the context needed to make informed, risk-based decisions. The CAB cannot determine whether a change deserves priority over competing requests or whether the maintenance window is appropriate. Business Context First COBIT 2019's BAI06 practice recommends evaluating change requests against business case alignment before technical feasibility. Every change request should open with a business impact statement before any technical details appear. Key questions: What business capability does this change affect? What happens if we do not make this change? What is the blast radius if this change fails? Creating a Business Service Catalog A business service catalog links technical components to business capabilities: Business Capability Technical Components Order Processing CRM system, payment gateway, inventory DB Employee Onboarding Active Directory, HRIS, email system Customer Support Contact center, knowledge base, ticketing Linking Change Management to the CMDB The CMDB should be the foundation of change impact analysis. When a change is proposed, the system should automatically: Identify affected CIs Show dependent services Assess business impact Identify stakeholders Automating Business Context Use automation to populate business context: Technical impact: Automatically pulled from CMDB Business impact: Derived from service relationships Stakeholders: Automatically identified from service ownership Training Change Submitters Change submitters need to understand what business context to provide: Training topics: How to write business impact statements How to identify affected business capabilities What information the CAB needs The Business Impact Statement Template text Change: [Brief description of the change]   Business Capability Affected: [What business function or service is impacted?] Impact if Not Done: [What happens if we don't make this change?] Blast Radius if Change Fails: [What is the potential business impact if the change fails?] Business Priority: [High/Medium/Low] Business Owner: [Who is accountable for the business impact?] Conclusion Prioritizing business context in change enablement ensures that changes are evaluated based on business impact, not just technical details. By linking change management to business capabilities, organizations can make better decisions about which changes to approve and prioritize. Action Items for Your Organization Create a business service catalog Link change management to the CMDB Require business impact statements for all changes Train change submitters on business context Use automation to populate business context

"High Risk" Isn't Enough — How to Quantify IT Risk in Dollars the Board Understands Why Quantify Risk? Moving from qualitative ("High risk") to quantitative ("$2.3M annualized exposure") assessments transforms risk management from a compliance exercise into a strategic decision-making tool . Three Quantification Approaches Approach 1: Basic Risk Scoring The simplest quantitative approach multiplies likelihood by impact on numerical scales: Risk Score = Likelihood (1–5) × Impact (1–5) Example: Likelihood = 4 (likely), Impact = 5 (catastrophic) → Risk Score = 20 (Critical) Mapping to risk tiers: Critical: 20–25 High: 15–19 Medium: 8–14 Low: 1–7 Limitations: This approach is subjective and doesn't produce dollar values. Approach 2: Annualized Loss Expectancy (ALE) ALE combines the probability of a risk event occurring in a given year with the estimated financial loss per event : ALE = Annual Rate of Occurrence (ARO) × Single Loss Expectancy (SLE) Example: If your organization estimates a 20% annual probability of a data breach (ARO = 0.2) with an average cost of $4.88 million per incident (SLE) → ALE = 0.2 × $4,880,000 = $976,000 Approach 3: FAIR (Factor Analysis of Information Risk) FAIR is the only internationally recognized standard for quantifying information risk in financial terms. Updated in January 2025, FAIR v3.0 uses the formula : Risk = Threat Event Frequency × Vulnerability × Loss Magnitude When to use FAIR: Need to justify security investments in financial terms Compare risk reduction ROI across projects Communicate risk to non-technical stakeholders Board-level financial justification Real-World Risk Quantification Example A manufacturing company assessing ransomware risk: Factor Value Annual probability of ransomware attack 15% (ARO = 0.15) Average loss per attack $4.88M (global average, 2024) Annualized Loss Expectancy $732,000 Board-level conversation: "We estimate our ransomware exposure at $732,000 annually. Investing $200,000 in backup and recovery controls could reduce this by 80%, saving approximately $585,000 per year." Benefits of Quantitative Risk Assessment Benefit Description Board alignment Board speaks dollars, not technical risk scores Investment justification Compare risk reduction ROI across projects Budget allocation Allocate resources where they deliver most value Risk prioritization Focus on risks with highest financial exposure Regulatory compliance Some frameworks require quantitative approaches Conclusion Quantitative risk assessment transforms risk management from a compliance exercise into a strategic decision-making tool. Organizations that quantify risk in financial terms can justify security investments, prioritize effectively, and speak the language of the board. Action Items for Your Organization Start with basic risk scoring if you lack data Move to ALE as you collect incident cost data Consider FAIR for board-level financial justification Document risk quantification methodology Use quantified risk data in board reporting  

You Can't Improve What You Don't Measure — Key Change Enablement Metrics Why Metrics Matter Measuring change management effectiveness helps organizations : Identify areas for improvement Demonstrate the value of change management Make data-driven decisions Track progress over time Key Change Management Metrics Readiness Metrics Employee readiness assessment results: How prepared are employees for the change?  Employee engagement, buy-in, and participation measures: How engaged are employees in the change process?  Stakeholder sentiment tracking: How do employees feel about the change?  Training Metrics Training participation, tests, and effectiveness measures: Are employees completing training and learning?  Training completion rates vs. behavior change observed: Is training translating into behavior change?  Adoption Metrics Usage and utilization reports: Are employees using the new tools or processes?  Compliance and adherence reports: Are employees following new processes?  % of users actively using the system post-go-live: What percentage are actually using the change?  Help Desk Metrics Internal help desk metrics: Tickets solved, tickets reopened, ticket escalations, issues by resolution area  Incidents and problems: Are change-related issues decreasing?  Business Impact Metrics Observations of behavioral change: Are employees working differently?  Project KPI measurements: Are project goals being met?  Benefit realization and ROI: Is the change delivering business value?  Adherence to timeline: Is the change on schedule?  How to Use Metrics For Improvement Identify problem areas: Which aspects are underperforming? Track trends: Are adoption rates improving? Benchmark: How do you compare to targets? For Stakeholder Communication Show value: Demonstrate the impact of change efforts Build credibility: Data-backed reporting builds trust Justify investment: Show where resources are needed The ITIL Perspective Key metrics for ITIL change enablement include : Percentage of changes implemented without incidents Average time from request submission to deployment (by change type) Number of changes that resulted in unplanned downtime Mean Time to Recover (MTTR) for issues caused by changes Conclusion Measuring change management success requires a balanced set of metrics covering readiness, training, adoption, and business impact. Organizations that measure effectively can identify problems, track improvements, and demonstrate value. Action Items for Your Organization Define your key change management metrics Set up measurement and reporting Establish baseline measurements Review metrics regularly Use data to drive improvement