The Audit Room Has Two Stories And Neither Is the Full Truth

Thu, 24 Apr 2025 00:00:00 +0000

This article was originally published in Dark Roast Security on Medium. Read the full post →

Every audit room has two stories playing simultaneously. The auditor walks in with a checklist, a mandate, and the quiet authority of an independent assessor. The auditee walks in with months of prep, a defensive posture, and the knowledge that something will be found — the only question is what.

The problem is neither side is telling their story particularly well. And that communication gap is where audits go from being useful to being theatre.

ChatGPT Policy for Your Organisation: The CISO's Concern

Sun, 09 Apr 2023 00:00:00 +0000

This article was originally published on not your CISO on Medium. Read the full post →

ChatGPT has been a buzzword for some time now. Be it a new product built on top of it or another capability announcement, just when you think the hype has peaked, something new drops. And through all of it, security teams have been quietly scrambling to figure out what their policy actually is.

This is not a technical breakdown of how large language models work. This is a practitioner’s take on the questions a CISO — or anyone responsible for security — needs to answer before their organisation gets too comfortable with ChatGPT in the workflow.

Grc on Rishipal Yadav · not your CISO

The Audit Room Has Two Stories And Neither Is the Full Truth

ChatGPT Policy for Your Organisation: The CISO's Concern