The Cybersecurity Compass

The Cybersecurity Compass

Home
Archive
About

July 2026

The Cybersecurity Compass Framework
Cybersecurity has a measurement problem, not a technology problem.
 • Juan Pablo Castro
Vulnpocalypse, Confirmed
I first heard the word a month ago. Anton Chuvakin used it in a post and asked the community for feedback on the definition.
 • Juan Pablo Castro
The Same Compass, a Different Ocean, Different Storms
When I introduced the Cybersecurity Compass some years ago, it was a different world.
 • Juan Pablo Castro
The SOC protects TODAY. The CROC protects TOMORROW.
Every organization runs on two clocks, and most of them are only watching one.
 • Juan Pablo Castro
The CISO Reporting Structure Is the Starting Point of Cyber Resilience Failure
In more than two decades in this field, I have seen no shortage of frameworks that map what a CISO is responsible for.
 • Juan Pablo Castro

June 2026

Current Cybersecurity Operating Models Do Not Operate at the Speed and Acceleration of the Attack Surface in the AI Age
We have spent years arguing about the size of the attack surface.
 • Juan Pablo Castro
Revisiting the Cyber Risk Management Lifecycle (CRML) in the Age of AI
In January 2024, the Cyber Risk Management Lifecycle, the CRML, took shape around a simple problem.
 • Juan Pablo Castro
The Future of SOC Is ∞
We say continuous more than almost any other word in cybersecurity.
 • Juan Pablo Castro
Rethinking Zero Trust for the Agentic AI Era
For thirty years, Zero Trust meant one disciplined idea.
 • Juan Pablo Castro
Six Powers in the Hands of the Adversary: When the AI Agent Becomes the Attacker's Best Hire
The most dangerous question a criminal ever asks is not how to break in.
 • Juan Pablo Castro
© 2026 Juan Pablo Castro · Privacy ∙ Terms ∙ Collection notice
Start your SubstackGet the app
Substack is the home for great culture