Cybersecurity

How we approach Cybersecurity

A control that cannot be evidenced did not operate

The gap that matters at audit, and during an incident, is between a control that exists and a control that can be shown to have run on a given day against a given asset. Policies describe intent. Logs, tickets and configuration state describe reality, and only the second kind survives contact with a regulator or an insurer. We build the evidence path at the same time as the control, because retrofitting it never happens.

The frameworks were written before the agent

NIST CSF and the CIS Controls remain the right backbone, and neither was drafted for software that holds credentials, takes actions and changes behaviour with its input. Prompt injection is not covered by input validation as written. Non-human identity does not fit an access review built around joiners and leavers. The frameworks still apply; the mapping needs doing honestly rather than by claiming the old control text already covers it.

Detection you have never tested is a belief

A rule that has never fired in anger is an assumption about a log format, a field name and a clock. Purple team exercises and deliberate detection tests are cheap next to the cost of finding out during an incident that the source stopped reporting in March. Test the detection, not just the control, and record the date it last actually caught something.