LeadershipOctober 2026 · 23 min read
The GRC Engineer's Playbook | Jim Venuto
The GRC Engineer's Playbook | Jim Venuto — an engineering-discipline take on GRC for SMBs and SLED organizations.
Practice area
Security Leadership
Fractional CISO advisory, program strategy, board-level reporting, security culture, and MSP-oversight leadership for SMBs and SLED organizations.
30 posts
LeadershipOctober 2026 · 14 min read
AI in Telehealth: Ambient Scribes, Chatbots, and the New Governance Surface
AI governance in telehealth: ambient scribes, chatbots, auto-summaries, and the new data pipelines they create. Learn how to evaluate AI features for privacy, security, and operational risk before they touch patient data.
LeadershipSeptember 2026 · 3 min read
NIST CSF 2.0 Govern: A 90-Day Rollout for the SMB Fractional CISO
The Govern function is the piece SMBs skip and auditors flag. Here's a 90-day rollout that fits a two-person IT team and produces board-legible evidence.
LeadershipApril 2026 · 14 min read
The Security Metrics That Actually Matter to Your Board — Jim Venuto
The Security Metrics That Actually Matter to Your Board — Jim Venuto — practical leadership guidance for security, privacy, and compliance program owners.
LeadershipApril 2026 · 14 min read
You Don't Need an Enterprise Security Program. You Need Someone Accountable. — Jim Venuto
You Don't Need an Enterprise Security Program. You Need Someone Accountable. — Jim Venuto — practical leadership guidance for security, privacy, and compliance program owners.
LeadershipFebruary 2026 · 6 min read
The Compliance Trap: Why 'HIPAA Compliant' Medical Groups Still Get Hacked
Your medical group passed its HIPAA audit and still got breached. Here's why 'compliant' doesn't mean 'secure' and what healthcare is getting wrong about cybersecurity.
LeadershipFebruary 2026 · 13 min read
Telehealth APIs: The Hidden Security Boundary Between Scheduling, Billing, Labs, and EHR
Telehealth API security risks exposed: how integration points between EHR, scheduling, billing, and lab systems create hidden attack surfaces. Platform security guidance for healthcare practices using NIST CSF 2.0 PR.PS controls.
LeadershipFebruary 2026 · 10 min read
The Telehealth Asset Inventory You Don't Have (and Why Attackers Love That)
Most telehealth practices can only name 3 systems containing PHI — but attackers find 17. Learn how to build a pragmatic asset inventory that maps every data flow, shadow IT system, and hidden PHI surface in your practice.
LeadershipFebruary 2026 · 9 min read
The Deprovisioning Gap: Former Staff Access Is the Most Boring Way to Lose a Practice
Healthcare employee offboarding failures cause 34% of breaches. Learn credential deactivation, access recertification, and deprovisioning runbooks aligned to NIST CSF 2.0 PR.AA for telehealth and medical practices.
LeadershipFebruary 2026 · 9 min read
Minimum Viable Governance for Small Practices: Board Metrics That Aren't Security Theater
Healthcare cybersecurity governance metrics that actually work. Six board-ready metrics for small telehealth practices — no jargon, no 47-slide decks, no security theater. Real oversight in 15 minutes quarterly.
LeadershipFebruary 2026 · 12 min read
The Home Wi-Fi Problem: A Telehealth Threat Model for Clinicians and Patients
Home network security is the overlooked risk in telehealth. Learn how to threat model clinician home offices, harden home Wi-Fi for virtual visits, and give patients simple guidance for secure telehealth sessions.
LeadershipFebruary 2026 · 9 min read
Protecting Hudson Valley Patients: Why Telehealth Providers Are Moving From 'Checklist' to 'Governance'
Hudson Valley telehealth providers face unique cybersecurity risks. Learn why local healthcare organizations are moving from HIPAA checklists to NIST CSF 2.0 governance.
LeadershipFebruary 2026 · 10 min read
Identity Is the Perimeter: Telehealth Access Control That Actually Holds
Telehealth identity and access control guide: MFA, zero trust, session controls, and deprovisioning SLAs for healthcare practices. NIST CSF 2.0 PR.AA aligned.
LeadershipFebruary 2026 · 9 min read
Logging Telehealth: What to Monitor, What to Alert, and What to Ignore
Telehealth security monitoring guide for small healthcare practices. Learn which signals matter, how to build a minimum viable detection program, and configure SIEM alerting for HIPAA-regulated environments using NIST CSF 2.0 DE.CM continuous monitoring.
LeadershipFebruary 2026 · 9 min read
Why HIPAA Compliance Isn't Enough: A NIST CSF 2.0 Guide for Telehealth
HIPAA compliance alone leaves telehealth providers exposed. Learn how NIST CSF 2.0's six functions close the gaps that checkbox compliance misses.
LeadershipFebruary 2026 · 10 min read
Session Recording and 'Convenience' Features That Quietly Create PHI Sprawl
Telehealth session recordings, AI transcripts, and convenience features create unmanaged PHI sprawl. Learn data classification, retention policies, and security controls for healthcare telehealth data under NIST CSF 2.0 PR.DS.
LeadershipFebruary 2026 · 8 min read
The 'Audit Hangover': Why the Riskiest Week Is the Week After You Pass
Post-audit security risks in healthcare: why the weeks after passing a compliance audit are the most dangerous, and how a 14-day security sprint converts audit confidence into operational hardening.
LeadershipFebruary 2026 · 13 min read
Ransomware During Clinic Hours: A Telehealth Tabletop That Forces Real Decisions
Healthcare ransomware incident response tabletop exercise for telehealth practices. A structured 90-minute exercise that tests your team's ability to respond to ransomware during clinic hours, maintain patient care continuity, and meet regulatory notification deadlines.
LeadershipFebruary 2026 · 6 min read
The Subculture Problem: Why Security Culture Programs Fail
Security culture initiatives fail because they treat the organization as monolithic. Learn how to diagnose subculture resistance and build targeted security behavior change programs.
LeadershipFebruary 2026 · 14 min read
The AI Policy You Wrote Last Quarter Is Already Wrong
AI governance policies are expiring faster than compliance cycles. Learn why quarterly AI policy reviews are essential and how to build adaptive governance that keeps pace with AI's evolution.
LeadershipJanuary 2026 · 14 min read
Your IR Plan Won't Survive Tuesday
Most incident response plans fail their first real test. Identify the gaps between your documented IR plan and actual response capability before an incident exposes them.
LeadershipJanuary 2026 · 18 min read
The County IT Director's Dilemma: Cybersecurity With a Municipal Budget
Municipal IT directors face enterprise-grade cyber threats with constrained budgets. Strategies for prioritizing cybersecurity investments in local government.
LeadershipJanuary 2026 · 9 min read
AI Cyber Risk: Why Your Firewalls Can't Stop Deepfakes and Shadow AI
Discover how AI is transforming cybersecurity threats: deepfake fraud, Shadow AI data leaks, and why traditional defenses are failing. Expert guidance on OWASP, NIST, and EU AI Act compliance.
LeadershipJanuary 2026 · 6 min read
AI Governance: A Lifecycle-Based Framework for Secure and Ethical Generative AI
A comprehensive governance strategy for generative AI centered on the Six-Level GenAI Governance (6L-G) lifecycle framework. Covers deployment models, unique AI risk profiles, and practical implementation for GRC programs.
LeadershipJanuary 2026 · 13 min read
The $15,000 Question: When a Fractional CISO Costs Less Than Your Next Breach
A fractional CISO engagement starting at $15,000/quarter delivers enterprise-grade security leadership to SMBs at a fraction of the cost of a breach or a full-time hire.
LeadershipJanuary 2026 · 14 min read
The Board Doesn't Want a Dashboard. They Want a Decision.
Board members don't need more metrics — they need actionable security decisions framed in business terms. A guide to transforming CISO board reporting from data dumps to decision frameworks.
LeadershipJanuary 2026 · 9 min read
The Question Your Board Will Ask This Year — And Why Most CISOs Aren't Ready
Boards are shifting from 'are we secure?' to 'what is our cyber risk exposure in dollars?' Most CISOs can't answer that question yet. Here's how to prepare.
LeadershipNovember 2025 · 8 min read
Understanding Reverse Engineering: A Guide for SMB Leaders
Understanding Reverse Engineering: A Guide for SMB Leaders — leadership guidance for security, privacy, and compliance program owners.
LeadershipNovember 2025 · 11 min read
AI in Cybersecurity - Dual-Use Arms Race
A strategic analysis of how AI is reshaping cybersecurity as both weapon and shield. Covers offensive AI threats, defensive capabilities, and governance challenges for organizational leadership.
LeadershipFebruary 2024 · 16 min read
When the EHR Goes Dark: A Recovery Playbook for Telehealth Practices That Can't Afford Downtime
A practical recovery planning guide for telehealth practices aligned to NIST CSF 2.0 RECOVER function. Covers backup strategies, RTO/RPO targets, communication templates, and a tested restoration runbook for small healthcare practices.