MONDAYMOVE
One concrete action.
Every Monday.
COMING UP
forward moves
Treat one agent as a first-class principal.
Agents are becoming the dominant actors in most environments, and the programs that give them real identities now won't have to retrofit it under pressure later.
access
Move one access decision out of the endpoint.
Most zero trust deployments left the policy sitting on the endpoint, which is the old perimeter wearing a new agent.
data
Read one week of DLP alerts you've been ignoring.
Your DLP queue is a behavioral record of what people are trying to do with sensitive data, and almost nobody reads it that way.
data
Define what "sensitive" means in one sentence.
People can't follow a classification scheme they can't repeat, and most schemes take a full page to explain.
inventory
Name every non-human identity in one system.
The industry ratio is roughly 45 machine identities for every human, and most programs can't produce the list for a single system.
identity
Add MFA to one service account that doesn't have it.
We added a second factor for the humans years ago and left the machines authenticating with a single static string.
identity
Pull the list of accounts that haven't logged in for 90 days.
Dormant accounts with live entitlements are pre-positioned access for an attacker who hasn't arrived yet.
inventory
Find one "vibe-coded" app running in production.
The new shadow IT ships in an afternoon, has no owner of record, and is already load-bearing.
ALL MOVES
Every move, in order.
data
Classify the ten things people actually touch.
A classification scheme too complex to use protects nothing, so start with ten files and a handful of labels you can say from memory.
detection
Put a two-hour clock on the first report.
Your team can contain a critical CVE in a day and still leave the people who have to make decisions blind for most of it.
governance
Run a State of the Team before anyone writes next year's plan.
The QBR tells leadership what the quarter's work added up to, and the people who did that work almost never hear it.
governance
Rewrite one metric as the protection level the business is buying.
Outcome-driven metrics turn a security report into a purchase decision the business has to sign.
governance
Trace one funded decision back to the day security first saw it.
In separate rooms, technology and security each planned for their own best outcome, and the board got shown one strategy.
governance
Find out who vetted the room.
Most events sell access to anyone who pays, and the fix starts with asking who decided you belonged there.
identity
Give one agent an identity of its own.
Every agent in your environment borrowed its authority from something else, and nobody wrote down how much of it came along.
forward moves
Write one team's charter with no tool and no skill in the sentence.
Your org chart is built out of skills, and the work stopped arriving in a shape those skills can own.
forward moves
Hand one thing you ruled out to somebody whose background looks nothing like yours.
A judgment I formed ten years ago was still running this week, and it had finished deciding before the meeting started.
governance
Say your entire program out loud, start to finish, and mark every sentence that will not close.
You can read your own program on the page and it holds together fine. Say it out loud and you hear the places where it does not.
detection
Take the operator delay out of every containment action that can only annoy somebody.
Every control in the chain performed to spec, the SOC hit its SLA, and the files left anyway, because the approval step is the only component still running at human speed.
inventory
Run the "shut it off" thought experiment on one tool.
Your stack has never gotten smaller, and the reason has very little to do with whether the tools work.
forward moves
Name an owner for everything that entered your environment in the last 90 days.
Your inventory describes what got onboarded. The exposure arrived after that.
data
Find every copy of your most sensitive dataset.
Your controls wrap the original. The exposure lives in the copies nobody logged.
identity
Rotate one stale secret you've been avoiding.
Every program has the secret nobody wants to touch. Rotating it is the audit your documentation missed.
governance
Convert your last planning review into one commitment sentence and send it before noon.
Your review produced a list. A list is not a commitment.
access
Architect the YES on one blocked AI use case.
Blocking AI is a decision to go blind. Build the yes instead.
forward moves
Pick one chokepoint and make it the policy plane.
The control plane is consolidating, and the gateway is where your policy starts to actually live.
forward moves
Write your next 90-day commitment in one sentence.
The fundamentals didn't change. The blast radius did.
identity
Audit one privileged group and remove one person.
Privileged access creep isn't a tool problem. It's a Monday habit.
detection
Stand up a logging path for one agent
Your AI agent is making decisions in your environment right now. You have no record of most of them.
governance
The Part Nobody Sells You
Security teams are trained to find gaps. No one trains them to see what's already working
inventory
Create a CBOM (Cryptographic Bill of Materials)
Know your public endpoints, TLS version and cypher suites before Friday