Notes on cyber security from someone who has to make it work. Vulnerability management, AI, supply chain risk, and the economics of attack and defence.https://daveferguson.blog/en-GBhttps://daveferguson.blog/how-ai-breaks-everything-we-know-about-cyber-economics/https://daveferguson.blog/how-ai-breaks-everything-we-know-about-cyber-economics/AI is simultaneously crashing the cost of building security controls AND the cost of attacking. Both curves are approaching zero. The winner won't be whoever spends the most, it'll be whoever moves the fastest. Here's why that changes everything about how we justify, fund, and deliver security.Sun, 05 Apr 2026 00:00:00 GMTAIhttps://daveferguson.blog/agentic-ai-governance-practical-guide/https://daveferguson.blog/agentic-ai-governance-practical-guide/AI agents are being deployed across your organisation without governance. Here's a practical 5-step framework for identity, privileges, and accountability.Sun, 29 Mar 2026 00:00:00 GMTAIhttps://daveferguson.blog/how-i-manage-my-tasks-in-cyber-security/https://daveferguson.blog/how-i-manage-my-tasks-in-cyber-security/The blog focuses on effective time management within the cybersecurity industry. It highlights the importance of prioritization as a skill and introduces a weekly planning strategy, centered around a mission statement. The author categorizes tasks into three groups: those that could lead to termination, those that could lead to promotion, and volunteering tasks. Emphasis is placed on the ability to say no and the value of task delegation, recognizing tasks that are unique to one's skills. The article aims to guide professionals in managing overwhelming workloads by aligning tasks with organizational goals and personal growth.Mon, 11 Mar 2024 00:00:00 GMTWays of workinghttps://daveferguson.blog/finding-the-best-cyber-security-initiatives-for-your-organisation/https://daveferguson.blog/finding-the-best-cyber-security-initiatives-for-your-organisation/Gain essential insights on choosing and implementing effective cyber security initiatives. This guide covers balancing limited resources with stakeholder engagement and the evolving threat landscape. Discover methods to measure ROI, tackle implementation challenges, and adapt to emerging cyber threats, ensuring your organisation's security aligns with its mission and operational needs. Ideal for enhancing your organisation's cyber security posture efficiently.Fri, 01 Mar 2024 00:00:00 GMTStrategyhttps://daveferguson.blog/simplifying-cyber-supply-chain-risk/https://daveferguson.blog/simplifying-cyber-supply-chain-risk/Pick high-quality suppliers but don’t blindly trust them. Assume your supply chain will be directly to indirectly compromised. It’s about resilient processes, not trying to prevent the…Thu, 22 Feb 2024 00:00:00 GMTSupply chainhttps://daveferguson.blog/developing-an-approach-to-attack-path-analysis-for-security-posture-management/https://daveferguson.blog/developing-an-approach-to-attack-path-analysis-for-security-posture-management/Developering an approach to attack path analysis which would work!Tue, 20 Feb 2024 00:00:00 GMTPosturehttps://daveferguson.blog/opensource-your-software-is-not-written-by-your-people/https://daveferguson.blog/opensource-your-software-is-not-written-by-your-people/An easy way to understanding Open-Source risks and the options available.Tue, 20 Feb 2024 00:00:00 GMTSupply chainhttps://daveferguson.blog/preparing-your-organisation-for-ai-cyber-warfare/https://daveferguson.blog/preparing-your-organisation-for-ai-cyber-warfare/Are you ready for the rise of the machines? As AI becomes more prevalent, it's time to start thinking about how to prepare your organisation for a world of AI Cyber Warfare.Sat, 17 Feb 2024 00:00:00 GMTAIhttps://daveferguson.blog/critical-vulnerability-management-cheat-sheet/https://daveferguson.blog/critical-vulnerability-management-cheat-sheet/A cheat sheet to help you manage critical vulnerabilities like a pro!Thu, 01 Feb 2024 00:00:00 GMTVuln management