Ideas that change how we think about cybersecurity.
Perspectives, original thinking, practitioner conversations and thought experiments about protection, investment, assurance and accountability.
Signature insights
Ideas worth carrying forward“Evidence of security is not proof of protection.”Explore the original 2023 article
Start with a question.
Follow the question that matters to you. Each opens a selection of related work, across formats and publication dates.
Three ways to rethink cybersecurity
Explore the thinking behind the library. Each idea leads to related work across formats; the selections below can evolve over time.
Understanding Protection
Security activity and individual controls do not, by themselves, tell us what protection an organisation can achieve against defined threats.
Explore related workLoading selected resources…
Aligning Expectations and Investment
Funding decisions should account for the protection investment makes possible, the limitations that remain, and the choices leaders need to make.
Explore related workLoading selected resources…
Establishing Confidence
Knowing how protected we are and knowing whether we can deliver and sustain that protection are different, but equally important questions.
Explore related workLoading selected resources…
Conversations from the Field
Four public 2025 practitioner conversations between Douglas Ferguson and customer CISO Lee Whatford. The linked pages preserve the original recordings and attribution.
A Better Picture of Security & Risk for the C-Suite and Board
Douglas Ferguson with Lee Whatford, customer CISO.
Open the conversationFrom the Conversation
Selected perspectives from public LinkedIn discussions, with their original context.
Follow your curiosity.
Substack is our publishing home for new articles. This library also connects historical publications and podcasts. Search by title or summary, or narrow it by theme and format.
No published resources match those filters. Try another search or show all themes and formats.