MONDAYMOVE
One concrete action.
Every Monday.
THIS WEEK
Hand one thing you ruled out to somebody whose background looks nothing like yours.
A judgment I formed ten years ago was still running this week, and it had finished deciding before the meeting started.
Read this move →Nobody has a list of these.
The full story is in — read it →COMING UP
access
Move one access decision out of the endpoint.
Most zero trust deployments left the policy sitting on the endpoint, which is the old perimeter wearing a new agent.
data
Read one week of DLP alerts you've been ignoring.
Your DLP queue is a behavioral record of what people are trying to do with sensitive data, and almost nobody reads it that way.
inventory
Name every non-human identity in one system.
The industry ratio is roughly 45 machine identities for every human, and most programs can't produce the list for a single system.
forward moves
Write one team's charter with no tool and no skill in the sentence.
Your org chart is built out of skills, and the work stopped arriving in a shape those skills can own.
identity
Map one agent's authority.
The model is rarely the risk, and three written answers about one agent will tell you whether your program can govern any of them.
inventory
Find one "vibe-coded" app running in production.
The new shadow IT ships in an afternoon, has no owner of record, and is already load-bearing.
forward moves
Treat one agent as a first-class principal.
Agents are becoming the dominant actors in most environments, and the programs that give them real identities now won't have to retrofit it under pressure later.
identity
Pull the list of accounts that haven't logged in for 90 days.
Dormant accounts with live entitlements are pre-positioned access for an attacker who hasn't arrived yet.
ALL MOVES
Every move, in order.
governance
Say your entire program out loud, start to finish, and mark every sentence that will not close.
You can read your own program on the page and it holds together fine. Say it out loud and you hear the places where it does not.
detection
Take the operator delay out of every containment action that can only annoy somebody.
Every control in the chain performed to spec, the SOC hit its SLA, and the files left anyway, because the approval step is the only component still running at human speed.
inventory
Run the "shut it off" thought experiment on one tool.
Your stack has never gotten smaller, and the reason has very little to do with whether the tools work.
forward moves
Name an owner for everything that entered your environment in the last 90 days.
Your inventory describes what got onboarded. The exposure arrived after that.
data
Find every copy of your most sensitive dataset.
Your controls wrap the original. The exposure lives in the copies nobody logged.
identity
Rotate one stale secret you've been avoiding.
Every program has the secret nobody wants to touch. Rotating it is the audit your documentation missed.
governance
Convert your last planning review into one commitment sentence and send it before noon.
Your review produced a list. A list is not a commitment.
access
Architect the YES on one blocked AI use case.
Blocking AI is a decision to go blind. Build the yes instead.
forward moves
Pick one chokepoint and make it the policy plane.
The control plane is consolidating, and the gateway is where your policy starts to actually live.
forward moves
Write your next 90-day commitment in one sentence.
The fundamentals didn't change. The blast radius did.
identity
Audit one privileged group and remove one person.
Privileged access creep isn't a tool problem. It's a Monday habit.
detection
Stand up a logging path for one agent
Your AI agent is making decisions in your environment right now. You have no record of most of them.
governance
The Part Nobody Sells You
Security teams are trained to find gaps. No one trains them to see what's already working
inventory
Create a CBOM (Cryptographic Bill of Materials)
Know your public endpoints, TLS version and cypher suites before Friday