August 27, 2026
Nobody accepts the service
A project closes, the budget closes with it, and operations inherits a system nobody agreed to support. Go-live is a date. Acceptance is a control.
Insights
What we think, and why.
Positions the practice actually operates on — not predictions about the industry.
Articles
Recent writing.
August 25, 2026
The runbook nobody reads
Every team I've run had a documentation problem, and none of them had a documentation problem. They had a "written by the wrong person at the wrong time" problem.
August 25, 2026
Vendors do what you inspect
On-time delivery went from under 20% to over 65% without renegotiating a single contract. What changed was what we measured, and who saw it.
May 25, 2026
What an SLA actually promises
A service level everyone reports green against and nobody trusts is worse than no service level at all.
May 5, 2026
Change governance without a committee
Half the change advisory boards I've seen approve everything and stop nothing. The board isn't the control — the risk assessment is.
April 25, 2026
Incident and problem are not the same thing
If the same outage keeps coming back with a new ticket number, you don't have an incident process worth fixing. You have a problem process you never built.
February 9, 2026
Running a major incident bridge
The failure mode of a big incident call isn't a lack of expertise. It's forty people on a bridge and nobody actually running it.
January 25, 2026
The first DR test should not be a real outage
Most disaster recovery plans are a document, an assumption, and a hope. You find out which one you had on the worst possible day.
Point of view
Three positions we will not argue out of.
01
A vulnerability program is a management system, not a scanner.
Tooling tells you what is wrong. It will not tell you who owns it, what it costs to leave open, or why the same finding reappeared last quarter. The programs that reduce risk are the ones with an ownership model, a remediation SLA that carries consequences, and an exception process that is harder to use than fixing the thing.
02
Audit readiness is a byproduct, not a project.
Organizations that scramble before an audit cycle are describing a governance gap, not an audit problem. When ownership, evidence, and remediation performance are captured continuously, the audit becomes a read of a system that already exists — which is what zero control failures actually looks like from the inside.
03
Modernization is a risk control.
The environments that miss remediation dates are almost always the ones nobody wants to touch: undocumented, hand-maintained, and dangerous to change. Automating delivery and making infrastructure declarative is not a developer-experience nicety. It is what makes a patch a routine event instead of a negotiation.
Tell us what is breaking, what is slow, or what you are afraid to touch.
Every engagement starts with a conversation about outcomes, not hours. If we are not the right fit, we will say so.