Working Security. Not washing it. on Roman Jasins

People First

Wed, 29 Jul 2026 00:00:00 +0000

Design alone isn’t enough. The best method in the world fails if the people inside it don’t adopt it. Adoption isn’t about training or motivation. It’s about making the work meaningful and intuitive.

You’ve built the connected model. Established the cadence. Right-sized the programme for your actual risks. And on paper, it all works beautifully.

Then you assign the first access review to someone in operations, and they ignore it for two weeks.

Proving It

Wed, 29 Jul 2026 00:00:00 +0000

The ultimate test isn’t passing an audit. It’s answering “are we secure enough?” at any moment, with reasonable confidence.

Your board asks: “Are we secure?”

You know the answer is complicated. You know that “secure” isn’t a binary state, that risk is contextual, that compliance isn’t the same as security, and that the programme has strengths in some areas and gaps in others. You know all of this, and you have about 10 minutes of the board’s attention.

The Compound Effect

Wed, 29 Jul 2026 00:00:00 +0000

Working Security’s real payoff isn’t in month one. It’s in year two, and beyond. When the programme starts giving back more than you put in.

The worst quarter and the best quarter

The worst quarter is the first one. You’ve done the honest inventory. You’ve picked your most painful area and connected it. You’ve run one cycle. The results were promising — the access review was clearer, the evidence was better, the person who did it actually understood the task. But the rest of the programme is still running the old way. You’re maintaining two systems. The connected model is incomplete. The cadence is established in one area but not yet in others. You’re spending more total effort than before, because transition work sits on top of operational work.

Everything Connects

Tue, 28 Jul 2026 00:00:00 +0000

Security parts don’t exist in isolation. When you build a programme that understands the connections between them, the impossible becomes manageable.

It’s 9:15 on a Tuesday morning and you’ve just seen the news. One of your cloud providers has disclosed a data breach. Customer data may have been exposed. Details are still emerging, but the news mentions “unauthorised access to customer account metadata.”

Your CEO wants to know if you’re affected. Your biggest client’s security team has sent an email asking for a statement. Your DPO wants to know if this triggers a GDPR notification obligation.

Make the Work Disappear

Tue, 28 Jul 2026 00:00:00 +0000

The goal isn’t to do more security work. It’s to make the necessary work efficient, well-timed, and distributed enough that it barely registers.

October. You know what’s coming.

The ISO surveillance audit is in six weeks. The management review is overdue. Half the access reviews that should have happened quarterly happened once, in February. The risk register hasn’t been touched since the last audit. Three policies are out of date — one references a system you decommissioned in March. Evidence folders are a mess of screenshots with names like final_v3_ACTUAL.png.

Start Where You Are

Tue, 28 Jul 2026 00:00:00 +0000

You don’t need to burn it all down. You need to be honest about what you have, connect what’s worth keeping, and let go of what was always fiction.

You’ve read the first eight chapters. Hopefully I managed to articulate how security programmes become performances. You understand why connections matter, why the cadence works, why proportionality is the missing conversation. And you’re sitting in front of your own programme — the one with the stale risk register, the policies nobody remembers exist, the evidence folder with screenshots from 2019, and the spreadsheet that only one person understands — and you’re thinking: where do I start?

The Right Amount

Tue, 28 Jul 2026 00:00:00 +0000

“How much security is enough?” is the question every business asks and no framework answers. It’s answerable — but only if you can see what you’re actually getting for what you’re spending.

It might go something like this. A CTO at a 35-person Series A B2B SaaS gets asked by a prospective enterprise customer whether they have ISO 27001 certification. They don’t. The deal is worth €400K annually. So the CTO does what any sensible person would do: panics quietly and calls a consultant.

Reality Check

Thu, 23 Jul 2026 00:00:00 +0000

Start from what’s real, and you will be protecting the business. Start from the framework, and you will be protecting a picture of the business that fits the frame.

You are in a kickoff meeting for an ISO 27001 implementation — a mid-size software company, about 80 people, with an experienced consultancy guiding the certification.

The consultant opens with: “Let’s start by going through the Annex A controls and identifying which ones apply to your organisation.”

The Blame Game

Thu, 23 Jul 2026 00:00:00 +0000

When security fails, we blame people. But individual failure is almost always a structural failure wearing a name badge.

It often goes like this. A mid-size company — about 200 people, with a software product — has a security incident. Not catastrophic, but real. An employee has reused a password across a personal account and a company system. The personal account gets breached. The attacker uses the same password to access the company’s environment. From there they pivot to a shared drive with company data. Nothing is taken, locked, or altered, as far as anyone can tell — but it’s close enough to hurt, and you can never be sure.

The Standards Trap

Thu, 23 Jul 2026 00:00:00 +0000

Standards were designed to help. In practice, they’ve become the problem — creating duplicate work, conflicting language, and an industry that profits from the complexity rather than reducing it.

You manage access to your production environment. You do it well. There’s a working process: joiners get access approved by their manager and provisioned by IT, movers get their access reviewed when they change roles, leavers get deprovisioned on their last day. The whole thing is reviewed quarterly. Evidence is collected — who approved what and when, with what justification. The control works.

The Overwhelm

Wed, 22 Jul 2026 00:00:00 +0000

People do the minimum because they’re overwhelmed, not because they’re lazy — and the problem is structural, not personal.

Here’s a job description. You’ll recognise it:

Security & Compliance Lead. Responsible for maintaining the organisation’s security programme, including risk management, policy development, access control, vulnerability management, incident response, vendor assessment, business continuity planning, security awareness training, audit preparation, regulatory compliance, and liaising with authorities. Reports to the CTO. Must be familiar with ISO 27001, SOC 2, GDPR, NIS2, and relevant industry frameworks. Experience with cloud security, application security, and network security preferred.

The Performance

Wed, 22 Jul 2026 00:00:00 +0000

Most security programmes perform to produce a certificate, not to protect the business. Everyone involved knows it.

You passed your security audit. Congratulations. The ISO 27001 certificate is on the wall. The sales team is already using it in proposals, and the LinkedIn post got 200 likes.

Let me ask you something. If a critical vendor went down tomorrow — the one that hosts your customer database, or the one that notifies users about transactions — how quickly could you identify which of your services are affected — not just the obvious ones? Which customers would be impacted? What contractual notification obligations kick in?