I'm a cybersecurity architect, instructor, and thought leader with over 20 years of combined experience helping organizations strengthen their security posture across government, financial, and enterprise sectors. Known for bridging the gap between technical implementation and executive decision-making, I bring clarity and strategy to an often-complex security landscape.
My mission is to empower organizations and individuals to make risk-informed, data-driven security decisions.
| Website | https://survivaltrait.com/ |
| https://www.linkedin.com/in/jennings-matthew/ |
Triage is what keeps an incident from becoming five incidents.
It’s how professionals prevent spread and protect what matters most.
Do you have shared triage language for systems during incidents?
#IncidentResponse #CyberSecurity #Leadership #Resilience #RiskManagement
Part 2 is live: The Field Manual. Templates and pocket cards you can copy and run.
Link: https://theisarchitect.substack.com/p/forged-by-fire-part-2-the-field-manual
#IncidentResponse #CyberSecurity #RiskManagement #Resilience
A one-page incident briefing prevents the worst failure mode: everyone running in different directions.
Name the incident, declare command, state objectives, set the next update time.
Do you start incidents with a real briefing?
#IncidentResponse #CyberSecurity #Leadership #Resilience #RiskManagement
Part 2 is the gear: The Field Manual.
Pocket-card tools for cyber IR: incident briefing, Cyber LCES, containment menu, recovery sequencing, AAR template.
If you could add only one this quarter, what would it be?
#IncidentResponse #CyberSecurity #RiskManagement #Resilience
Field Note is live: “The New Insider Threat Is Authorized.”
Two risks, one theme: failures that are authorized but violate intent.
Auditability and safe override are not nice-to-haves anymore.
https://theisarchitect.substack.com/p/the-new-insider-threat-is-authorized?r=7cykfo
If you are rolling out copilots or agents, ask:
1. What can it read?
2. What can it summarize and where can it display it?
3. What is logged?
4. What is the safe mode?
5. Who can disable it quickly?
Full Field Note is on my Substack today.
Part 1 is live: Forged by Fire. Wildfire incident response doctrine mapped to modern NIST incident response guidance (SP 800-61r3).
Link:
https://open.substack.com/pub/theisarchitect/p/forged-by-fire?r=7cykfo&utm_campaign=post&utm_medium=web&showWelcomeOnShare=true
