Sign in

padstone.io

@padstone.io
15 followers 53 following 12 posts

We are Padstone Security. Built to hold.

PostsRepliesMedia
padstone.io @padstone.io · 04/08/2026
Auditors aren't the enemy — they're working from a generic checklist applied to a system they've never seen. That's not a flaw, it's the job. Which means your documentation isn't just evidence. It's the judgment they can't supply themsel… padstone.io/insights/how-to-argue-w…
000
padstone.io @padstone.io · 27/07/2026
Forced password rotation doesn't improve security. It improves compliance scores. Summer2024! becomes Summer2024!!! and the audit log shows green. The user solved the problem you gave them. You just gave them the wrong problem. padstone.io/insights/intent-of-the-…
001
padstone.io @padstone.io · 09/07/2026
AI governance isn't a new discipline. It's what happens when organizations that skipped basic governance meet software that moves faster than they can react. padstone.io/insights/ai-governance
000
padstone.io @padstone.io · 25/06/2026
Most organizations are defending the wrong surface. Endpoints feel controllable, vendors love selling the certainty — but attackers live in identity, cloud config, and lateral movement. EDR is a comfort purchase. padstone.io/insights/endpoint-secur…
000
padstone.io @padstone.io · 28/05/2026
Most security policy exists as a document someone approved and nobody reads. Here's what it looks like when the environment itself has the opinion — and enforces it at deploy time. padstone.io/insights/policy-as-code…
010
padstone.io @padstone.io · 20/05/2026
Most security programs are accurate descriptions of a program nobody built. The docs are right. The controls are mapped. The audit passed. The environment does something else entirely. padstone.io/insights/everything-as-…
000
padstone.io @padstone.io · 14/05/2026
Manual controls aren't controls. They're intentions. If a human has to remember to run it, you've already lost the consistency that makes it a control at all. padstone.io/insights/automation-imp…
000
padstone.io @padstone.io · 05/05/2026
Weak security isn't a people problem. It's an architecture problem. If your environment allows anything, your policies mean nothing. Constraints have to be structural — not cultural. padstone.io/insights/make-the-wrong…
000
padstone.io @padstone.io · 24/04/2026
Most risk registers aren't risk management. They're audit theater. High/medium/low tells you nothing about actual exposure — it just tells you someone filled out the form. padstone.io/insights/risk-register-…
022
padstone.io @padstone.io · 20/04/2026
Threat modeling done as an audit exercise produces documentation nobody reads. Done as engineering, it drives what you build, what you protect, and where you spend. The difference isn't process. It's intent. padstone.io/insights/threat-modelin…
010
padstone.io @padstone.io · 14/04/2026
Most security programs fail before a single tool is deployed. The org never decided who owns what, who decides what, or what gets measured. You can't stack capabilities on nothing. padstone.io/insights/governance-fir…
000
padstone.io @padstone.io · 14/04/2026
Policy documents rot in SharePoint because no one can see what changed, when, or why. Git fixes that. Version control, diffs, review workflows — everything compliance needs and never gets from a wiki. padstone.io/insights/policies-on-git
010