September 14, 2026
The first DR test should not be a real outage
Every organization I've worked in had a disaster recovery plan. Most of them had never been executed by the people who would actually have to execute it. …
Insights
What I think, and why.
Positions the practice actually operates on.
Articles
Recent writing.
August 27, 2026
Nobody accepts the service
A project closes, the budget closes with it, and operations inherits a system nobody agreed to support. Go-live is a date. Acceptance is a control.
August 25, 2026
The runbook nobody reads
Every team I've run had a documentation problem, and none of them had a documentation problem. They had a "written by the wrong person at the wrong time" problem.
August 25, 2026
Vendors do what you inspect
On-time delivery went from under 20% to over 65% without renegotiating a single contract. What changed was what we measured, and who saw it.
May 25, 2026
What an SLA actually promises
A service level everyone reports green against and nobody trusts is worse than no service level at all.
May 5, 2026
Change governance without a committee
Half the change advisory boards I've seen approve everything and stop nothing. The board isn't the control — the risk assessment is.
April 25, 2026
Incident and problem are not the same thing
If the same outage keeps coming back with a new ticket number, you don't have an incident process worth fixing. You have a problem process you never built.
February 9, 2026
Running a major incident bridge
The failure mode of a big incident call isn't a lack of expertise. It's forty people on a bridge and nobody actually running it.
Point of view
Three positions I won't be argued out of.
01
A vulnerability program is a management system.
Tooling tells you what is wrong. It will not tell you who owns it, what it costs to leave open, or why the same finding reappeared last quarter. The programs that reduce risk are the ones with an ownership model, a remediation SLA that carries consequences, and an exception process that is harder to use than fixing the thing.
02
Audit readiness is a byproduct of how you run.
Organizations that scramble before an audit cycle are describing a governance gap. The audit only exposes it. When ownership, evidence, and remediation performance are captured continuously, the audit becomes a read of a system that already exists. That is what zero control failures actually looks like from the inside.
03
Modernization is a risk control.
The environments that miss remediation dates are almost always the ones nobody wants to touch: undocumented, hand-maintained, and dangerous to change. Automating delivery and making infrastructure declarative is not a developer-experience nicety. It is what makes a patch a routine event instead of a negotiation.
Tell me what's breaking, what's slow, or what you're afraid to touch.
Every engagement starts with a conversation about outcomes, not hours. If I'm not the right fit, I'll be the first person to tell you.