Slides and remarks from my talk at GovWare 2026, Singapore, 13 October 2026.
Gravity.
Gravity.
It’s about gravity.
The three gravitational forces that tear you, as CISO, into pieces.
Security is a function of finance.
We are loss prevention.
Where does the financial impact come from?
The regulator. The legal system.
First and foremost.
Oh no! A data breach. Anyway...
A rational, for-profit enterprise does not care.
Unless they are made to care.
By the regulator.
For most security teams today, this is the threat model.
Little bit of ransomware to keep things spicy.
Here’s the problem.
Defending your employer from the regulator does not secure you against real adversaries.
It would be nice if it did. That’s clearly the intention of the regulator.
But we all know, I think, that’s not how it works in practice, right?
Worse, I argue being compliant makes you less secure against real adversaries.
Pilots run their pre-flight checklists. Watch them on the tarmac next time you fly. Pre-flight checklists work because the physics of flight are the same each time.
Surgeons run their pre-op checklists. Checklists work in the operating room because the patient is not trying to outsmart the surgeon.
Checklists save lives.
They don’t win wars.
Checklists don’t win wars.
There is no checklist substitute for adversarial thinking.
I speak from experience.
In crypto, data breaches are the least of my concerns.
Product teams screaming at you because we lack PMF and we took $150M of VC funding and security is slowing down the business and if we don’t figure out how to make money we go bankrupt.
My SOC 2 paperwork shuffling devoid of any defensive security benefit, I perform security theater, collecting “evidence”, maintaining “policies”, keeping it light, to support the business, so we can make money and not go bankrupt.
BUT--I actually have to be secure! Because meanwhile, North Korea wants to steal all my employer’s crypto and our users’ crypto. Lose a billion dollars and you go bankrupt.
CISO, torn in three.
By gravity.
The three-body problem.
Take this with you. From this talk.
This is my problem today. Your problem tomorrow.
What happens when cyber risk exceeds compliance risk, and by several orders of magnitude?
GDPR -- 4% of annual revenue.
DPRK -- you go bankrupt.
Not on this slide--BitGet just the other week, $300M.
North Korea has stolen billions of dollars of fungible, non-reversible digital cash. From companies just like my employer. In order to fund their nuclear weapons program.
That’s not crime. That’s not piracy.
That’s something else.
There is a word for it. We’ll get there.
DPRK dominates all other threat actors in my vertical. They are by far the apex predator in my employer’s threat model. Roughly 80% of all stolen crypto is stolen by North Korea.
80%.
Maybe you think, that doesn’t affect me. Affect real banks. Real money.
Systemic risk! DeFi connects across chains and, increasingly, has hooks into TradFi.
Traditional Finance.
Five domains of commerce.
Were you expecting another word?
Commerce.
Land. Sea. Air. Space. Cyber.
But when a sovereign nation engages in coercive violence on one of these domains, to advance their geopolitical goals, there’s a common sense, ordinary word for that.
North Korea wages undeclared, de facto war on private companies just like my employer.
The world is changing.
This talk is a telegram from the future. Because the future is already here. It’s just not evenly distributed yet.
We have enjoyed mostly peace at sea and on the cyber domain because of the global hegemon.
At sea, for the last 200 years.
The British, then the US.
On cyber, for the last 30 years.
The entire history of the internet.
The cyber domain.
The newest domain of commerce.
The newest domain of warfare.
Consider--what happens when that power fades.
Weakens.
At sea--observe Hormuz. The world police have failed.
On land. Study history. Europeans didn’t know the Roman Empire fell.
They just knew no one came to fix the roads and the bridges fell down and it became unsafe to travel.
Unsafe for commerce.
Then the invaders came.
I argue this function, the function of a hegemon weakening, will now happen on the cyber domain, and with similar consequences.
Data breaches. The regulator. A little ransomware.
That’s over.
Multipolarity is a nice word for regression to the mean.
A period of warring states.
At planetary scale, this is the human normal.
The last 30 years of a global hegemon was an aberration never before seen.
Maybe never to be seen again.
We have hints from the past of what’s to come. Maersk lost only $300M because of a power outage in Ghana.
The Maersk office in West Africa.
One domain controller survived.
Without that?
They could have lost $3B. Even more.
Maersk was not a target. They got hit by accident and they survived by accident.
Luck is not a strategy.
I repeat: Luck is not a strategy.
This is a telegram from the future.
Because crypto is the future of enterprise security.
My problem today. Your problem tomorrow.
The OT folks know what I’m talking about.
The cyber domain is the control plane for the real world.
You know...
The human race used to live in meatspace and “go online”. Remember?
Now we live online. Our life on the cyber domain is more real in some ways than in meatspace.
The human race has migrated onto the cyber domain.
This is our new home.
For better or for worse.
The end of cyber hegemony spells the end of compliance as a substitute for real security.
It also kills off that green book and CRQ nonsense.
Cyber Risk Quantification.
Because you can quantify the risk of cyber crime under a hegemon who polices the commons.
You cannot quantify the tail risk of cyber war when the hegemon leaves.
I will be blunt.
War is coming. On the cyber domain.
And you cannot quantify that risk and you cannot insure against war.
And when you cannot transfer risk--insurance--what are you left with?
Risk acceptance.
And risk mitigation.
When facing catastrophic risk, risk acceptance is not an option.
Risk mitigation is what I do. Your internal security team is the only cyber risk insurance you can buy at this scale.
Where does that leave the CISO?
Fighting a war. A defense-only war.
This is how I think of my own job. As a defense-only military general.
I have to be to do my job.
“Defense-only” because we don’t get to shoot back.
And fighting a war where Westphalian borders are obsolete and every adversary lives next door, a sub-second hop from every box on earth.
A war. Not checking boxes for the regulator.
Not a legal battle.
A real battle.
On the cyber domain.
Raw power. Unchained from law and norms.
Catastrophic risk.
Existential risk.
The named adversaries in your threat model. Who want to destroy you.
Bankrupt you.
In the beginning, there were two masses only.
The market and the adversary.
But for-profit enterprises focused on this quarter’s bottom line don’t understand or care about security.
So the regulator intervened.
It’s a hard job, being a cybersecurity regulator. Aligning financial incentives here is insanely difficult.
Maybe impossible.
Shareholders demand profit. So you can’t change the market. Not really.
And a private company doesn’t wield the geopolitical force to project power against a nation-state adversary to change their behavior.
So the only option left is for the regulator to get creative.
To regulate better.
That’s what the rest of this talk is about.
Good news.
The Great Financial Crisis of 2008 broke ground for us.
The answer is not another checklist.
Or another framework.
Dodd-Frank. The Fed. The OCC.
A Chief Risk Officer, who reports to the Board, and who the CEO cannot fire.
For the board to hear and see the risk from a risk expert.
The Chief Risk Officer is required to tell the Board when he disagrees with the CEO.
Only the Board--the owners of the company--can accept risk, or fire the Chief Risk Officer.
Agree? Or disagree?
I disagree. Do you think a Wall Street--or Singapore--board member, with decades of finance and legal experience, has the foggiest idea about cybersecurity?
With respect.
The US regulator tried.
Security is expensive and the risk of the third body is silent and invisible.
And the heart of American capitalism is that private enterprise captures all upside exposure and Washington nationalizes all downside risk.
The taxpayer. The money printer.
Shout out to MAS for a job well done. Curious to know how this is working out in practice.
If you’re a regulator in the room, I’d love to chat off the record after this and hear your point of view.
Two security centers of gravity. Two security programs.
The regulator. And your named adversaries on the cyber domain.
Two different masses, two different, only slightly overlapping security programs.
Separate the cyber defense budget. Make the CISO a board-reporting Chief Cyber Risk Officer the CEO cannot fire.
Give us a voice in the board room to do the right thing and say what we think is right.
Then let the board take responsibility.
It’s out there.
The third body.
Silent. Invisible.
It’s coming.
Here.
Will you be ready?
