Information security policies are often treated as pure paperwork—something written once during initial certification, approved by executives without being read, filed away in a dusty portal, and dusted off only when an auditor schedules a review. Over my 30 years in governance, risk, and compliance, I have seen far too […]

Information security fails far more often because of unclear ownership than weak technology. Over my 30 years in governance, risk, and compliance, I have seen far too many small businesses, tech startups, and growing teams assume that “security is an IT problem.” When a data breach, ransomware incident, or auditor

Many security incidents don’t happen because controls don’t exist—they happen because too much power sits with one person or one role. Over my 30 years in governance, risk, and compliance, I have seen far too many small businesses, tech startups, and growing teams grant global administrative privileges to a single

Information security programmes rarely fail because policies are missing. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations draft spotless security policies only to fail completely because management behaviour did not match stated intent. When executives demand exception passes around Multi-Factor Authentication (MFA),

When a serious information security incident occurs, confusion about who to contact, when, and how often makes a bad situation infinitely worse. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations waste critical hours during an active cyber attack frantically searching for the

Information security does not exist in isolation. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations build their security controls in a complete vacuum, relying entirely on internal guesswork or static textbooks while the rest of their industry sector is actively adapting to

Threats change faster than most static control sets. Over my 30 years in governance, risk, and compliance, I have seen far too many small businesses, startups, and tech firms build their security controls around outdated 10-year-old threat assumptions or generic compliance checklists—completely oblivious to the active, real-world attack techniques targeting

Many security weaknesses are introduced during change, not day-to-day operations. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations invest heavily in securing existing production environments, only to allow project teams to launch new software platforms, migrate core databases to the cloud, or

You cannot protect what you do not know you have. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations invest heavily in advanced cyber defenses while remaining completely blind to unmapped cloud storage buckets, orphaned databases, legacy physical servers, or unvetted SaaS applications

Most information security incidents involve misuse, not technical failure. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations invest heavily in next-gen firewalls, endpoint detection, and complex cloud security tools, only to suffer a disastrous breach because an employee installed unvetted shadow IT

Information security risk does not magically end when an employee, contractor, or third-party vendor separates from your business. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations execute swift logical offboarding—disabling Microsoft 365 or Slack accounts—while completely forgetting about the physical company laptop,

Not all information needs the same level of protection. Over my 30 years in governance, risk, and compliance, I have seen far too many small businesses, startups, and tech teams fall into two fatal traps: either treating every single internal document like a national security secret (paralyzing operations and creating

Information classification schemes only work if people can instantly recognize them in practice. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations craft complex 5-tier classification policies that sit in a drawer, while staff handle sensitive documents, customer PII, and commercial code completely

Information is often most vulnerable when it is moving. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations invest heavily in firewalls and encrypted databases, only to leak sensitive commercial secrets or bulk customer PII because an employee sent an unencrypted email to

Access control is where policy, people, and technology meet. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations write ambitious security policies only to fail at the execution level because access was granted informally, permissions were assigned “just in case,” or legacy credentials

Identity is the fundamental gateway to access. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations invest heavily in firewalls, endpoint detection, and data loss prevention while leaving their front door wide open through chaotic identity management. Unmanaged identity sprawl—orphaned contractor accounts, duplicate

Authentication information is often the last line of defense between an attacker and your sensitive systems. Over my 30 years in governance, risk, and compliance, I have seen far too many organizations invest heavily in next-gen firewalls and complex cloud monitoring, only to suffer a disastrous breach because an admin

Access control decisions only become effective when access rights are correctly granted, changed, and removed in real time. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations draft spotless access control policies, only to suffer catastrophic breaches because a departed employee’s VPN account

Your security posture is only as strong as your weakest supplier relationship. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations build ironclad internal perimeters, only to hand over global administrative credentials, unencrypted customer databases, or direct network connections to unvetted third-party suppliers.

Supplier risk is rarely caused by bad intent—it is caused by unclear expectations. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations rely on informal verbal promises, glossy vendor marketing claims, or generic commercial purchase orders that contain zero security language. When a

ICT supply chains introduce risk long before systems go live. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations carefully configure their internal firewalls and cloud environments, only to inherit devastating vulnerabilities, backdoors, or malicious code through unvetted third-party software libraries, compromised hardware

Supplier risk does not stay static. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations conduct a rigorous security assessment during supplier onboarding, sign a tight contract, and then completely ignore the vendor for three years. In the meantime, the supplier migrates its

Cloud services change the control boundary, not the responsibility. Over my 30 years in governance, risk, and compliance, I have seen far too many small businesses, startups, and tech teams adopt SaaS, PaaS, and IaaS platforms under the dangerous assumption that AWS, Azure, Google Cloud, or Microsoft 365 handles “all

Incidents rarely fail because teams don’t try hard enough—they fail because planning happened too late. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations wait until ransomware is actively encrypting their file servers or customer data is leaking onto the web before trying

Not every security event is an incident, but failing to recognize the difference creates massive risk. Over my 30 years in governance, risk, and compliance, I have seen far too many organizations fall into two extreme traps: either treating every single automated SIEM ping or minor spam email as a

Incident response is where preparation is tested under pressure. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations write comprehensive disaster recovery plans and incident playbooks, only to panic when a real-world breach occurs—improvising containment steps, leaking unverified information to the media, destroying

Incidents only become valuable when organisations actually learn from them. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations rush through incident containment and recovery, issue a quick patch, and close the ticket—only to suffer the exact same breach three months later. Closing

When security incidents escalate, evidence quality determines outcomes. Over my 30 years in governance, risk, and compliance, I have seen far too many incident response teams rush to reboot compromised servers, restore backups, or wipe infected drives to restore uptime, completely destroying volatile forensic memory in the process. When you

Disruption changes operational priorities, but security must never be sacrificed in the chaos. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations manage a major crisis—whether a physical disaster, a network outage, or a cyber incident—by completely disabling core security controls just to

When disruption strikes, your ICT capability determines how quickly your business recovers—or if it recovers at all. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations confuse basic data backups with true business continuity. Having an off-site tape or cloud snapshot means nothing

Information security obligations do not exist in isolation. They are shaped, bounded, and enforced by law, regulation, and contract. Over my 30 years in governance, risk, and compliance, I have seen far too many security teams design technically brilliant architectures that completely fail in practice because they ignored the legal

Intellectual property risk is often invisible—until it becomes extremely expensive. Over my 30 years in governance, risk, and compliance, I have seen far too many small businesses and tech startups fall into the trap of assuming that paying for a single software license allows them to deploy it across an

Records quietly underpin trust, accountability, and compliance across your business. When they are lost, altered, or inaccessible, the damage is rarely technical—it is organisational, legal, and financial. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses treat records as static files sitting in

Personally Identifiable Information (PII) is not just another data type on your servers. It carries severe legal obligations, regulatory scrutiny (such as GDPR, CCPA, or UK Data Protection Act), and reputational risk by default. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations

Security programmes drift when they are never challenged. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations fall into the trap of self-validation, assuming that because their internal IT team built a control, it must be running effectively. Over time, operational shortcuts become

Security controls only work if people actually follow them. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations draft immaculate, comprehensive security policies, stick them in a PDF on an obscure intranet page, and assume that documentation equals protection. Write-and-forget policies are useless.

Security breaks down when critical tasks rely on memory, habit, or assumption. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses build impressive technical architectures, only to suffer catastrophic outages or data leaks because “Dave in IT” was on holiday and nobody else

People are often the first control an organisation relies on and the first risk if trust is assumed rather than verified. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations invest heavily in cloud firewalls, zero-trust architectures, and expensive SIEM platforms, only to

Information security responsibilities start before day one. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations rely on new hires reading a dense policy document weeks after starting, or assuming that employees “just know” their security obligations. Policy acknowledgments are useful, but if

Security controls fail most often through human misunderstanding, not technical weakness. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations invest heavily in firewalls, SIEM platforms, and zero-trust tools, only to run an uninspiring 45-minute slide deck once a year during onboarding and

Policies without consequences are suggestions, not controls. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations write beautiful, comprehensive security policies, only to ignore breaches when they are committed by high-performing sales leads or senior executives. When policy violations are swept under the

The risk does not end when someone leaves your business. In many cases, it increases dramatically. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations run smooth technical onboarding processes, only to completely fumble off boarding, leaving active credentials assigned to departed contractors,

Confidential information only stays confidential if expectations are clear and legally enforceable. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations rely on informal trust, handshakes, or generic, copy-pasted templates when sharing high-value IP, customer databases, or trade secrets with staff, contractors, and

Remote working changes where work happens, not who is responsible for security. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations deploy corporate VPNs and assume their remote security is complete, while completely ignoring the human and physical realities, like family members using

Security incidents are rarely sudden. Most major breaches start as small, observable events that were simply not reported in time. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations spend heavily on automated detection tools while failing to cultivate a culture where staff

Cyber security starts with where people can physically go. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations spend thousands on firewalls, SIEM tools, and complex encryption, only to leave their physical office boundary wide open. If an attacker can walk into your

Physical access is the last step before compromise. Once an unauthorized individual gets past your front door or into your server room, many of your most expensive logical security controls are already bypassed. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations spend

Once someone is inside the building, security failure becomes a proximity problem. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations invest heavily in front-desk reception turnstiles and perimeter keycards, only to leave internal server closets unlocked, HR offices open to casual visitors,

Physical security controls only work if breaches are detected, not just prevented. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations spend thousands on heavy vault doors, keycards, and physical barriers, only to leave them completely unmonitored. When an unauthorized visitor tails an

Not all security threats are digital. Some arrive as fire, water ingress, extreme heat, power surges, or civil disruption. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses build military-grade firewalls and zero-trust software architectures while completely ignoring physical reality, like placing primary

A secure area is only secure if behaviour inside it is strictly controlled. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations invest heavily in biometrics, man-traps, and heavy vault doors, only to allow staff and contractors to wander around server rooms unmonitored,

Most information leaks do not involve clever external hacking. They involve what was left behind. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses spend heavily on firewalls and threat detection tools while leaving customer files sitting on unattended desks, passwords written on

Where equipment is placed often matters as much as how it is secured. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations deploy state-of-the-art encryption and firewall rules, only to place core network switches in unlocked utility closets under leaky water pipes, or

The moment an asset leaves your building, your physical office controls stop working. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations invest millions in badges, security guards, and server room locks, only to hand employees unmonitored laptops and mobile devices to use

Storage media is small, portable, and remarkably easy to forget—which is precisely why it represents one of the highest physical data loss risks in any business. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations implement flawless cloud perimeters and firewalls, only to

Information systems fail quietly when the utilities they depend on fail first. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses focus exclusively on software firewalls and cloud permissions while ignoring the physical foundations of their business—like server room air conditioning units, central

Cabling is easy to overlook, until it fails. When it does, entire services disappear instantly. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations spend thousands securing cloud endpoints, firewalls, and server racks, only to leave critical fiber runs and power feeds exposed

Equipment does not usually fail suddenly. It fails because maintenance was inconsistent, unauthorised, or overlooked. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations treat hardware maintenance as a purely operational background task, right up until a third-party engineer plugs an unmonitored USB

Equipment doesn’t stop being a security risk when it stops being useful. In many cases, that is when the risk peaks. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations spend heavily on perimeter security only to throw retired servers, laptops, printers, or

User endpoint devices are where most cyber attacks succeed. Laptops, smartphones, and tablets sit directly at the boundary between your people, your networks, and your data—and they are routinely operated outside your physical office perimeter. Over my 30 years in governance, risk, and compliance, I have seen far too many

Most major security incidents do not start with exotic zero-day malware. They start with too much access, held for too long by a legitimate user. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations hand out permanent “Domain Admin” or global root rights

Most data breaches are not caused by clever external hacking. They happen because someone inside or connected to the business had access they simply did not need. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations treat access as a default entitlement or

Source code is not just technical material. It is your organisation’s intellectual property, operational logic, and security enforcement mechanisms all wrapped into one. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses treat source code repositories like open digital filing cabinets, granting blanket

Authentication is the front door to your information systems. If it is weak, every single security control behind it is completely exposed. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses spend heavily on advanced firewalls and encryption, only to get compromised because

Security incidents are not always caused by clever external attackers. Many are caused by systems simply running out of capacity. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations treat capacity as a routine IT performance issue, right up until a database disk

Malware rarely announces itself. It blends into everyday emails, innocent file downloads, compromised software updates, and routine maintenance until systems stop working, files are encrypted, or data is quietly exfiltrated. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses place blind, absolute faith

No system is ever completely vulnerability-free. The real risk comes from not knowing what weaknesses exist, or reacting too slowly when you do. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations treat vulnerability management as an occasional, reactive firefighting exercise. They run

Most security weaknesses are not exotic, zero-day exploits. They are simple misconfigurations that quietly accumulate over time. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations spend a fortune on advanced threat detection tools while leaving default passwords active, unneeded ports open, or

Information that is no longer needed is not harmless. It is unmanaged risk waiting to be exposed. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations hoard decades of legacy customer files, old database dumps, and forgotten cloud snapshots under the excuse that

Not everyone who needs data should be able to identify people or see sensitive financial details. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations hand full, raw production databases over to developers, support staff, or third-party analytics partners just so they could

Most data loss does not involve clever hackers breaking into your network. It involves sensitive data quietly leaving through normal business channels that nobody was watching. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations spend a fortune on firewalls, only to lose

Backups are not about convenience. They are about survival when something goes wrong. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses take comfort in a green dashboard checkmark showing a “successful backup,” only to discover during a real ransomware attack or server

Availability is not achieved by hope. It is achieved by designing systems that continue to operate when something fails. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses suffer catastrophic downtime because they assumed their systems were redundant simply because they were in

If you cannot see what is happening in your environment, you cannot protect it. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations treat logging as a passive technical by-product, something that sits quietly in the background accumulating dust until a major incident

Security incidents rarely arrive without warning. The warning signs are almost always there inside your systems—if you are actually looking for them. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations collect millions of system log lines every single day, only to store

When system clocks disagree, the truth becomes hard to prove. Over my 30 years in governance, risk, and compliance, I have seen far too many security investigations completely collapse because system logs differed by just a few minutes. Imagine trying to piece together a cyber attack timeline when your firewall

Utility programs are powerful by design. That power is exactly why they need tighter control than ordinary software. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations leave administrative utilities, system diagnostics, and low-level disk tools sitting openly on production servers for “convenience.”

Most serious production outages do not start with clever external attackers. They start with uncontrolled software changes inside live environments. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses let well-meaning engineers or staff apply “quick updates,” unapproved utilities, or untested patches directly

Networks are where information moves, and where attackers look first. If your network is not controlled, every single device connected to it is completely exposed. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations treat their network as a background transport layer, focusing

Networks are only as secure as the services running on them. If your network services are weak, protected systems quickly become irrelevant. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses spend heavily on perimeter firewalls, only to leave directory services, email routing,

Once an attacker gets a foothold in your network, they do not stop at a single system. They move sideways until they find your core databases, domain controllers, or financial tools, unless the network stops them. Over my 30 years in governance, risk, and compliance, I have seen far too

Encryption is not a “nice to have”. Used properly, it is one of the single most effective controls for protecting your information. Used poorly, it creates technical fragility, operational risk, and false confidence. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses flip

Most software vulnerabilities are not caused by clever attackers. They are designed in, long before code ever reaches production. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses treat security as a final checkbox or a last-minute penetration test right before go-live. The

Applications are where your data lives, where decisions are made, and where money changes hands. Over my 30 years in governance, risk, and compliance, I have seen organisations deploy state-of-the-art firewalls and hardware encryption, only to get completely ruined because their core web application lacked basic security rules. If your

Most security failures are not caused by missing security tools. They are caused by poor design decisions made early and never revisited. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses bolt expensive security appliances onto a fundamentally flawed network design, only for

Most application vulnerabilities are not sophisticated. They are basic coding mistakes repeated at scale. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses spend fortunes on firewalls and penetration testing while their development teams write hardcoded passwords, ignore input validation, and copy-paste unvetted

Most security failures are discovered after deployment, when fixing them is slow, expensive, and disruptive. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations run comprehensive tests on software functionality, only to go live with massive security holes because no one bothered to

Outsourcing development does not outsource your risk. Over my 30 years in governance, risk, and compliance, I have seen dozens of companies buy expensive custom software from external agencies, only to find out during an audit or a security incident that the developers built massive security flaws right into the

Many major security incidents are not complex, external cyber attacks. They are simple, accidental changes made in the wrong environment. Over my 30 years in governance, risk, and compliance, I have seen developers accidentally drop a database or release unverified code simply because they thought they were connected to a

Most security incidents are not caused by sophisticated new threats. They are caused by poorly controlled changes. Over my 30 years in governance, risk, and compliance, I have seen countlessly well-meaning IT staff push a quick fix or configuration tweak, only to bring down the whole network or accidentally expose

Test environments are essential for building reliable software. But taking a copy of your live database and dumping it straight into a test environment without controls is one of the fastest ways to cause a major data breach. Over my 30 years in governance, risk, and compliance, I have seen

Audits are supposed to reduce risk. Handled badly, they create it. Over my 30 years in governance, risk, and compliance, I have seen plenty of well-meaning auditors accidentally cause system outages or extract sensitive data without proper controls. Uncontrolled audit testing is a security incident waiting to happen. ISO 27001:2022

Most cyber attacks do not break through your front door with brute force. They get invited in through a normal web browser. I see this all the time in real-world audits. An employee clicks a link, visits a bad site, and suddenly your business is dealing with a major incident.