Built a crisis exercise page this week. First version had the scenario as the page heading, so the team knows what it's about. That was the bug. A staff exercise starts with a situation, not a script. If they know the ransom note lands at T+40, they wait for it. Heading removed.

Dienstag stehe ich mit meinen beiden Mitgründern auf der DIGITAL X in Köln, im Startup Harbour am Rheinauhafen. Zwei mal zwei Meter, ein Bildschirm, drei Disziplinen: Informationssicherheit, Datenschutz, IT-Betrieb. Speed Dating 11, 13 und 15 Uhr. #DigitalX

A write protection that lives in the edit form is not a write protection. It holds until someone hits the same record through bulk edit, the API, or a console. If a record is meant to be immutable, that belongs in the data model, on every write path, including yours.

Most compliance paperwork documents the work. With classified material the paperwork is the work: who held it, who signed for it, when it was destroyed, who witnessed that. Plenty of places still keep it in a paper book. In there an expired clearance looks like a valid one.

The first sign of a breach is almost never an alert. It's a ticket. Machine got slow. Mailbox locked. That mail looked odd. Three locked accounts in one hour is a pattern, but only if one person sees all three. Split across a helpdesk tool and an ISMS, nobody does.

TLS certs are going from 398 days to 47 by 2029. Everyone reads that as more renewals. The expiry that bites you is never the one on your main domain, it's the internal box someone set up in 2019. Short lifetimes don't add work, they audit your inventory.

Every GRC brochure promises compliance at the push of a button. That line is the tell. A tool doesn't close a gap, it shows you one. The dangerous state was never the open problem, it's the green checkmark that quietly stopped matching reality. Build the mirror, not the button.

Regulators stretched the critical-infra audit cycle to 3 years. Sounds like relief, it's the opposite. The longer the gap between two snapshots, the less either one means. Evidence gathered the month before the deadline says nothing about a random Tuesday in year two.

Every B2B deal now opens with a security questionnaire. Half the questions repeat across every customer, yet someone answers them by hand each time. A glossy PDF proves nothing, it's stale the day it ships. Fix: a live posture page fed from the systems doing the actual work.

German law makes companies 50+ run a whistleblower channel. Most built an inbox and quietly hope nothing lands in it. Wrong goal: every report that reaches you internally is one that didn't go to the regulator or the press. A channel nobody uses isn't clean, it's distrusted.

The first ransomware run end to end by an AI agent got documented this week. Everyone's fixated on the machine. Look how it got in: a year-old CVE, a 2021 bug, default creds. Zero zero-days. Machine speed doesn't need a clever door when the old ones are still open.

"500 integrations" is a vanity metric. The one your project ships on is in no catalog: the homegrown tool, the 2015 legacy box, the 2am export script. Integrability lives at the edge, not the middle. Can you get data out, or are you stuck waiting on a vendor's roadmap?

43% of sites set tracking cookies before anyone clicks accept. Not malice. Nobody knows what their own page actually loads. A tag manager pulls a tag that pulls three more. You can't consent-gate what you can't see. Audit what loads before you write the banner.

Everyone's trying to inventory their containers. Wrong altitude. A pod lives minutes. Track each one and your inventory's stale before you read it. Clusters, nodes, the images actually running: that's what stays. That's the asset. Pods are just execution.

Most GRC tools model a supplier 4 times: once in the questionnaire, once in the contract, once as a data processor, once in the risk register. Four records, four truths, all drifting. We made it one object, four views. Compliance rot is a data-modeling problem.

The EU CRA clock starts Sept 11: actively exploited vuln = early warning in 24h, full report in 72h. 24 hours is nothing if you're still figuring out which product ships the affected component. Filing the report is easy. Knowing your own stack fast is the hard part.

Most datacenter docs are a lie with a timestamp: correct the day they're drawn, wrong after the first swap. So we built DCIM where the rack shows live load + each device's real power state. Docs you don't maintain, because they just reflect reality.

20 years of pentests: the way in was almost never a clever 0-day. It was the forgotten subdomain, the cert nobody tracked, the staging box that quietly went public. Defenders work from last quarter's asset list. Attackers scan today. That gap is the whole game.

The wild part of building solo with an AI pair isn't that it writes the code. It's that it frees up the hours for the work that actually needs 20 years of judgment: where the trust boundary goes, what must never leave the box, which edge case is the whole product.