The People Your Breach Harms Are Not Your Employees
When a mission holds data on vulnerable people, a breach transfers the harm to them. Why that changes who your security controls are really for.
Your Board Does Not Need a Better Deck. It Needs a Decision to Make.
Directors rate security reporting poorly not because the slides are wrong but because nothing in them asks the board to decide anything.
An AI That Invents a Citation and an AI That Outs a Person Are Not the Same Risk
An AI that invents a citation and one that outs a person are not the same risk. For nonprofits and healthcare, the difference is measured in safety.
Nobody Reviewed the AI You Already Bought
AI governance keeps failing before the policy gate. The riskiest AI arrived inside tools you already approved, on by default. Where to start looking.
Your People Were Never the Weakest Link
When a colleague clicks a phishing link, they are the first victim, not the weak link. Why the language we use about our people carries a budget.
Your AI Policy Is Not a Control Until Someone Can Fail It
policy you cannot violate is a document, not a control. Here is the difference, and why it decides whether you have actually governed AI.
The Donor Data You Forgot You Were Holding
Why "we're too small to be a target" is the most expensive assumption in mission-driven work.