CISO Tradecraft® Newsletter

For over two decades, the cybersecurity community has treated quantum computing as a “next decade” problem. Because scientifically viable quantum hardware, the kind capable of cracking modern encryption, does not yet sit in our data centers, it is often dismissed as a theoretical risk for the year 2035 or beyond. This assumption is a strategic failure. Quantum readiness is no longer a future-dated research project; it is a fiduciary responsibility and a prerequisite for long-term data sovereignty.

The cybersecurity leadership landscape is undergoing a fundamental transformation, moving away from the traditional view of the Chief Information Security Officer (CISO) as the career apex. As the role becomes increasingly fluid, senior practitioners are transitioning into diverse positions such as Field CISOs, Operating Partners at venture capital firms, and hybrid executives (CTOs or CIOs).

Think about the last time you sat in a board meeting. Did the directors lean in when you talked about firewall throughput or packet offsets? Probably not. But they definitely sat up when you talked about risk appetite, business objectives, and regulatory assurance. Many leaders view Governance, Risk, and Compliance (GRC) as a “boring” necessity or a mountain of tedious paperwork.

In the sweltering heat of a mid-summer afternoon, sitting on a farm and relying on a Starlink terminal for a digital lifeline, we sat down with Michael Hammer, a man who has been navigating what he calls the “internet fad” since the mid-1970s. Hammer is the embodiment of the cybersecurity “graybeard.” He comes from an era where off-the-shelf security didn’t exist; if you wanted a protocol to work, you had to roll your own from open source or build it from the guts of the standards themselves.

In the time it takes to read this sentence, an AI agent somewhere has likely pushed a block of code into a production environment. For years, we’ve spoken about the “speed of business,” but we have entered a new era: the speed of the prompt.

Why CISOs Must Break Up With the “Original Sin” of Cybersecurity Imagine for a second that your entire multi-million dollar security infrastructure is being held together by a standard designed in 1977. Back then, we created password requirements (eight characters, uppercase, lowercase, special symbols) specifically to ensure a PDP-8 computer would take 60 days to crack it. We then arbitrarily cut that time to 30 days and told users to rotate their passwords every month.

In January 2003, the internet didn’t just slow down; it broke. The culprit was a 376-byte ghost, a worm smaller than a typical email signature, that infected 75,000 hosts in just 10 minutes. If the earlier Code Red worm was the digital equivalent of an AK-47, the SQL Slammer was a Vulcan Gatling gun, the kind of high-power hardware mounted to an A-10 Warthog. It didn’t just spread; it obliterated everything it touched, crippling bank ATMs, debit networks, and long-distance telephone systems.

Most executives mistake a frantic schedule for impact. They view their expertise as a shield, unaware that their indispensability is actually a bottleneck. True high-performance leadership, learned in the kill zones of the Navy SEAL teams and the boardrooms of “weirdo” visionaries, demands a counter-intuitive objective: working yourself out of a job. The most effective leaders aren’t the smartest people in the room; they are the architects of systems that thrive in their absence.

For the last two years, the enterprise world has been obsessed with “passive” Large Language Models (LLMs). We treated AI like a brain in a jar, a sophisticated chatbot that could answer questions but lacked the ability to interact with the physical or digital world. As cybersecurity expert G Mark Hardy puts it, we are now trying to figure out how to keep the “genie in the bottle” as that brain develops arms and legs. We have officially entered the era of Agentic AI.

The Security Information and Event Management (SIEM) platform is supposed to be the central nervous system of your defense. Yet, the industry is haunted by horror stories of multi-year implementation timelines and massive contracts that end in silence during a breach. Whether it’s a broken parser, a capped license that stopped ingesting logs right before the “big one,” or a team so exhausted by the tool’s complexity that they missed the signal in the noise, SIEM failures are rarely small.