J Wolfgang Goerlich

I’m the unflinchingly optimistic graybeard, wandering in this cyber dystopia. InfoSec, cybersecurity, futurist, strategist, chaotic good. The views expressed are my own. Sometimes humorously.
 https://jwgoerlich.com

Last Notes

2026-06-16 01:58:31 UTC

Please. Repeat after me:
AI is not an employee. AI is not a teammate. AI is not a friend.

2025-11-22 06:20:13 UTC

- reply

CSRB, the NIST 800 team, CISA, ISACs for multi-state and elections. It’s a mess.
Happy to share how this is impacting local (county) governments, if that’s a route you explore.

2025-09-20 22:13:50 UTC

Most of us build controls like we’re plugging leaks in a roof. A drip here, a patch there. Before long, the ceiling looks like a quilt of yesterday’s fixes.
It works until the next storm.
But the adversary doesn’t think in leaks. They think in flow. They’re already mapping where the water will run tomorrow. If our job is just plugging holes, we’ll always be one step behind.
The shift comes when we stop seeing security as patchwork and start seeing it as plumbing. How is data flowing? Where will pressure build? Who has the wrench when something bursts?
Good security isn't reacting to breaches. Good security is anticipating how attackers will reroute around today’s controls. Our job is to channels the flow so tomorrow’s storm has fewer places to break through.
That's defensibility.
(PS: Yes, I'm doing work on my house. How did you guess?)

2025-09-18 16:18:21 UTC

InfoSec:
"Never ever click on emails, all emails are malware."
Also InfoSec:
"Check out this new security feature which provides passwordless login right from an email link."

2025-09-12 09:36:05 UTC

LOLs per Employee: a vital metric.
Shenanigans are a sign the team has sufficient energy in reserve, signaling readiness for handling emergencies and unplanned work. Play usually reflects underlying trust, cohesion, and resilience.
Encourage it.

2025-09-02 12:21:27 UTC

Give an investor three points on a graph, and they’ll plot a exponential curve. Any three points. Every time.

2025-08-07 17:14:08 UTC

Opened up Instagram to see a number of friends clustered in Las Vegas.
This is a problem. No, not because Sin City. Because Instagram apparently opted in everyone.
Turn it off under chat.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/988/603/383/604/732/original/4d4b1ac97f642e34.png

2025-06-25 16:38:39 UTC

Them: "In order to make this change, I need to verify you. I'll do this with a one-time text."
Me: Sure.
Them: "We have no phone number on file."
Me: ...
Them: "Not to worry. I'll update your account. What number would you like to use?"
#CustomerService > #Security

2025-05-15 16:57:04 UTC

We *must* get away from security which depends upon a full inventory. It was difficult back when things were mostly static and mostly ITIL. It is practically impossible at 2025 velocities.

2025-04-19 21:58:59 UTC

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/366/869/208/114/881/original/9fda5b98b09dba2c.png

2024-10-20 23:25:26 UTC

I couldn’t solve a Captcha. I am very much human. But there’s too much visual noise.
So I screenshot the Captcha and got the answer from ChatGPT. I’m in! Modern problems, modern solutions.

2024-10-20 15:20:18 UTC

If your first thought is, “maybe they never happened because we worried,” then a career in cybersecurity might be right for you.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/340/419/534/791/007/original/18ea6b18525a26d0.png

2024-09-21 19:58:07 UTC

The Anarchist Cookbook. One of the kids brought home the Cookbook. He paid $45 for the book. Anarchy, in this economy!?

2024-09-04 23:04:12 UTC

Occam's Razor: the simplest explanation, with the fewest assumptions, is the correct explanation.
Wolf’s Electric Shaver: the silliest explanation, with the most dramatic dysfunctions, is the correct head-cannon.