https://cisoexpert.com/ Cybersecurity leadership, strategy, and the human side of information security. en https://cisoexpert.com/tools/embedding-space-navigator https://cisoexpert.com/tools/embedding-space-navigator Pick a topic and a prompt, and watch where the answer comes from. AI answers run on nearness, not truth. Mon, 02 Nov 2026 00:00:00 GMT https://cisoexpert.com/articles/llm-visualizer-article https://cisoexpert.com/articles/llm-visualizer-article A free, MIT-licensed browser tool that shows how language models place meaning in space. It makes one point land for non-specialists: AI retrieval runs on nearness, not truth. Use it to open your next AI vendor review or team conversation. Sat, 31 Oct 2026 00:00:00 GMT https://cisoexpert.com/articles/the-mcp-gateway-land-grab https://cisoexpert.com/articles/the-mcp-gateway-land-grab Every SaaS vendor is shipping agents through MCP servers, and identity, data, monitoring and platform vendors are all racing to sell the gateway that watches them. Start from what agents have already broken, then ask five questions before you buy. Wed, 28 Oct 2026 00:00:00 GMT https://cisoexpert.com/articles/counting-ai-efficiencies-in-bananas https://cisoexpert.com/articles/counting-ai-efficiencies-in-bananas Is AI more energy-efficient than a person? Measured in bananas, AI wins clearly on short, well-defined tasks. Long agent work is close enough that how you count picks the winner, and a person wins whenever judgment stops wasted retries. On price, the person wins almost everywhere. Sat, 10 Oct 2026 00:00:00 GMT https://cisoexpert.com/tools/ai-energy-calculator https://cisoexpert.com/tools/ai-energy-calculator How much energy does an AI answer use compared with a person doing the same task? Count it in bananas, steaks or dollars, and change any number you disagree with. Sat, 10 Oct 2026 00:00:00 GMT https://cisoexpert.com/articles/4-billion-bet-on-data-pipes https://cisoexpert.com/articles/4-billion-bet-on-data-pipes Two years of security deals put the money into telemetry pipelines, observability and security data lakes, not detection or AI models. If you're about to sign a SIEM, platform or MSSP contract, judge vendors on who controls your data and how you get it back, not on the AI demo. Fri, 02 Oct 2026 00:00:00 GMT https://cisoexpert.com/articles/your-decisions-are-the-bottleneck https://cisoexpert.com/articles/your-decisions-are-the-bottleneck AI can do security work in seconds, but the work still waits in queues and SLAs built for human speed. Compare each SLA with how fast AI can do the same step, automate the steps that need no judgment, and set clear rules for when containment blocks and when it goes to a person. Sun, 27 Sep 2026 00:00:00 GMT https://cisoexpert.com/articles/how-to-talk-like-a-ciso-the-language-of-business https://cisoexpert.com/articles/how-to-talk-like-a-ciso-the-language-of-business Security leaders lose decisions when they report on controls instead of choices. A question-stage note: why I think the translation fails, what the SEC's 2023 rule implies about who carries it, and a way to start practising this week. Sun, 27 Sep 2026 00:00:00 GMT https://cisoexpert.com/frameworks/mountain-maturity https://cisoexpert.com/frameworks/mountain-maturity A mountain-climbing analogy that translates NIST CSF maturity levels into a five-stage narrative - Basecamp through Summit Standard - that boards and executives grasp without a framework briefing. Mon, 21 Sep 2026 18:00:00 GMT https://cisoexpert.com/articles/mcp-annotation-gap-ecosystem-analysis-v2 https://cisoexpert.com/articles/mcp-annotation-gap-ecosystem-analysis-v2 An MCP scanner I'm building found no tool safety hints (read-only, destructive, open-world) on any of 16 public MCP servers. Without them, an agent client can't tell a read from a delete, so every call looks equally risky. What I found, what it doesn't prove, and what to check. Sat, 06 Jun 2026 00:00:00 GMT https://cisoexpert.com/articles/mcp-annotation-gap-ecosystem-analysis https://cisoexpert.com/articles/mcp-annotation-gap-ecosystem-analysis On 2026-05-21 I scanned 16 public MCP servers for tool annotations, the hints agent clients use to decide when a human approves an action. The scanner flagged all 16, and one of those results is wrong. Here is what the gap means for approval gates, and what to check before you adopt a server. Thu, 21 May 2026 00:00:00 GMT https://cisoexpert.com/articles/2026-04-27-what-ai-should-shouldnt-do-in-your-soc https://cisoexpert.com/articles/2026-04-27-what-ai-should-shouldnt-do-in-your-soc Only 9% of security practitioners are "very confident" in AI-generated alerts - yet adoption is accelerating. The gap comes down to a distinction the demos never make: AI at decision points in a workflow is not the same as AI replacing the workflow. Here is which use cases earn their keep. Mon, 27 Apr 2026 19:00:00 GMT https://cisoexpert.com/articles/2026-04-09-data-lake-searchability-architecture https://cisoexpert.com/articles/2026-04-09-data-lake-searchability-architecture You moved security data to a lake and cut costs. Then an investigation hit and your team spent two weeks finding what should have taken hours. The difference between a cheap archive and a queryable security asset comes down to three architecture decisions most organizations haven't made yet. Thu, 09 Apr 2026 19:00:00 GMT https://cisoexpert.com/tools/claude-prompt-timer https://cisoexpert.com/tools/claude-prompt-timer Claude Code can't tell whether you left for two minutes or eight hours, so it picks up stale threads as if nothing changed. claude-prompt-timer is a small hook that tells it how long you've been away. Install it in three steps and confirm it works in one. Thu, 09 Apr 2026 00:00:00 GMT https://cisoexpert.com/articles/2026-04-01-siem-cost-trap-data-lake-ai-agents https://cisoexpert.com/articles/2026-04-01-siem-cost-trap-data-lake-ai-agents The per-gigabyte SIEM pricing model punishes growth. A tiered architecture - hot data for detection, cold storage in a data lake, AI agents bridging the gap - breaks the cost trap without sacrificing security outcomes. Here's how to make the case to your leadership. Wed, 01 Apr 2026 19:00:00 GMT https://cisoexpert.com/articles/2026-03-22-ai-pen-testing-rsa2026 https://cisoexpert.com/articles/2026-03-22-ai-pen-testing-rsa2026 Security testing has always been an economics problem: defenders can only test what they can afford to test. AI changed the cost of testing, and that changes which assumptions about coverage still hold. Sun, 22 Mar 2026 19:00:00 GMT https://cisoexpert.com/articles/2026-03-18-four-generations-broken-promises https://cisoexpert.com/articles/2026-03-18-four-generations-broken-promises Three generations of security tooling promised to fix the analyst shortage. All three failed. The fourth - AI SOC Agents - operates on a different principle, but CISOs who ignore twenty years of lessons will repeat the same expensive mistakes. Wed, 18 Mar 2026 19:00:00 GMT https://cisoexpert.com/articles/2026-03-17-glassworm-invisible-unicode-ai-code-scanner https://cisoexpert.com/articles/2026-03-17-glassworm-invisible-unicode-ai-code-scanner GlassWorm hid malicious code in invisible Unicode characters. I scanned 152 files of my own AI-generated code to see whether the same trick was already sitting in my repositories - and built a pre-commit check from what I found. Tue, 17 Mar 2026 19:00:00 GMT https://cisoexpert.com/articles/2026-03-04-the-claude-code-cves-hit-close-to-home https://cisoexpert.com/articles/2026-03-04-the-claude-code-cves-hit-close-to-home Check Point disclosed two Claude Code CVEs exploiting hooks and MCP config files. Here's what the attack chains look like and how to harden your environment. Wed, 04 Mar 2026 19:00:00 GMT https://cisoexpert.com/articles/how-i-made-claude-code-safer-and-you-can-too https://cisoexpert.com/articles/how-i-made-claude-code-safer-and-you-can-too Claude Code validates which tools can run, not what they write. That gap cost me a crashed project and a malformed config file - so I built a plugin that validates content before it hits disk, and it turned out to teach Claude to stop repeating the same mistakes. Tue, 10 Feb 2026 19:00:00 GMT https://cisoexpert.com/tools/document-guard https://cisoexpert.com/tools/document-guard An open-source Claude Code plugin that inspects every file edit before it hits disk - catching credential leaks, silently dropped Markdown sections, and broken configs that permission rules alone don't stop. Tue, 10 Feb 2026 00:00:00 GMT https://cisoexpert.com/articles/i-ran-849-tests-on-ai-context-files-heres-what-actually-works https://cisoexpert.com/articles/i-ran-849-tests-on-ai-context-files-heres-what-actually-works 849 controlled tests across three corpus sizes and five folder structures found that a single flat folder with descriptive filenames beats nested hierarchies at every scale - and that keyword or summary indexes actively hurt accuracy once a corpus passes 300K words. Thu, 05 Feb 2026 19:00:00 GMT https://cisoexpert.com/articles/how-i-made-claude-code-10-30x-faster-with-pre-selection-hooks https://cisoexpert.com/articles/how-i-made-claude-code-10-30x-faster-with-pre-selection-hooks Guidance that arrives before a decision beats guidance buried in instructions. By intercepting tool choices before they happen, I cut code-navigation searches from ~300ms to ~50ms - a 10-30x improvement that compounds across hundreds of searches a day. Wed, 04 Feb 2026 19:00:00 GMT https://cisoexpert.com/articles/4-essentials-for-executive-business-buyin-on-your-incident-response-plan https://cisoexpert.com/articles/4-essentials-for-executive-business-buyin-on-your-incident-response-plan Four things an incident response plan needs before executives will stand behind it: response SLAs the business agrees to, a clear split between operational and strategic plans, formalization of processes you already run rather than net-new invention, and a signature from the C-suite. Fri, 23 Dec 2022 05:51:26 GMT https://cisoexpert.com/articles/top-5-things-for-a-successful-cyber-response-ir-plan https://cisoexpert.com/articles/top-5-things-for-a-successful-cyber-response-ir-plan Having an incident response plan at all is associated with a 43% reduction in breach cost. Here are the five things that separate a plan that holds up under pressure from one that sits unread - with practical examples for each. Wed, 12 Jan 2022 01:02:00 GMT