Walk the tool inventory of most mid-size security programs and you'll find three products doing signature and behavioral detection on the endpoint, two doing it again on the network, and nobody who can tell you, without a meeting, whether a given vulnerability class is actually covered end to end. That's not defense-in-depth. That's five vendors billing for the same job. Defense-in-depth got named for a reason: depth. Layers. The idea was never "buy more of the same control so a failure is less … [Read more...]
NIST CSF 2.0’s Govern Function Makes Architecture Governance an Audited Control, Not a Best Practice
A framework doesn't usually gain a new function just to hand you a new checkbox. NIST CSF 2.0's Govern function is the exception, and I don't think most architecture teams have reckoned with why yet. When NIST published CSF 2.0 in February 2024, Govern didn't get tacked onto Identify as an afterthought. It became its own standalone function, defined as the work to "establish and monitor organization risk management strategy, expectations, and policy," and it carries six categories: … [Read more...]
Secure by Design vs. Secure by Default: They’re Not the Same Control
CISA's Secure by Design pledge started small, 68 software manufacturers signed on in May 2024. By CISA's count in June 2026, that list had grown to 367 signers, and the agency used its August 10, 2026 announcement to spotlight fresh commitments from leading technology providers. Good news, worth tracking. But buried in the pledge itself is a distinction I keep seeing vendor evaluations flatten into one question. Two of the pledge's seven goals are about what ships turned on: no default … [Read more...]
I Bought a Short-Term Rental Sight Unseen. Here’s What Actually Happened.
Buying a house you've never set foot in is either bold or stupid, and in March of 2025 I found out which one applies to me. It was a short-term rental play in Bradenton on the Florida Gulf Coast, a decent bones house in a good pocket near the water, and I bought it off photos and a video walkthrough because the numbers on paper looked right and I didn't want to lose it to someone who could move faster. Jumping on it fast was still the right decision, but doing it "sight unseen" came with some … [Read more...]
Vendor Risk Assessment Belongs in Architecture Review, Not Just Procurement
Forty-eight percent of breaches in 2026 involved a third party, according to Verizon's Data Breach Investigations Report. A year earlier that number was 30 percent. That's roughly a 60 percent jump in twelve months, and if your organization's vendor risk process still lives entirely inside procurement, that trend line isn't someone else's problem to solve. It's yours. Here's the pattern, and I'd bet money it isn't unique to any one company. Procurement runs the RFP, scores vendors on price and … [Read more...]
Best of Breed Is Usually the Wrong Call: The Integration Bill Comes Due Later
Best-of-breed is a procurement decision wearing an architecture costume. It gets treated like the rigorous choice, because somebody ran a bake-off, scored the features against a checklist, and picked the tool that came out on top, and that feels like diligence. It isn't, not fully. Feature depth was never the whole question, it was just the question that was easy to score. The real question is what it costs to connect that tool, secure it, and carry it for the next five years, and that number … [Read more...]
Architecture Governance Only Works When the Loop Closes
Governance programs don't usually fail from missing policy. Most boards I've sat on already have a principles document, a review process, an exception form, some kind of vendor questionnaire. What they don't have is a loop that closes, where each piece actually feeds the next one instead of sitting in its own binder. A decision gets made without an ADR. An exception gets approved without an expiration date anyone tracks. A vendor clears procurement before architecture ever sees the data flow. … [Read more...]
AI Agent Sprawl Is SaaS Sprawl With Better PR
Three million AI agents are now running inside corporate environments, according to Gravitee's State of AI Agent Security 2026 report, and the mean monitoring coverage across those estates sits at 52%. That's not a rounding error. That's an entire shadow estate of autonomous software making decisions, calling APIs, and touching data with almost no one watching. Put that next to Gartner's forecast that 40% of enterprise applications will ship with task-specific AI agents embedded by the end of … [Read more...]
An Architecture Exception Without an Expiration Date Isn’t an Exception
A credential issued in 2022 for a limited pilot integration at Klue sat active for roughly four years after the pilot itself was quietly abandoned. Nobody owned it. Nobody reviewed it. Nobody put a date on the calendar for it to stop working, and that last part is the whole story. When the extortion group Icarus went looking for a way in, that single dormant token turned into the entry point for the Salesforce environments of close to 200 companies, according to TechCrunch's reporting on the … [Read more...]
What Belongs in an ADR (and What Doesn’t)
Somebody on your team probably wrote an ADR last month titled something like "Adopt Prettier for the billing service," or "Standardize on camelCase for internal package names." Go read it back in six months and ask what it's actually protecting. Nothing. It's not wrong, exactly, it's just not architecture, and it's sitting in the same collection as the decision about who owns the customer identity record, as if the two carry the same weight. That's how ADR programs actually fail, and it took me … [Read more...]
- 1
- 2
- 3
- …
- 5
- Next Page »