Articles by 'Ken Phelan'

By Ken Phelan, Posted in Security

If you're like me, you've read The Art of War. Or at least you've sat through a keynote where someone put it on a slide. I'm a book geek, so I've done both. Sun Tzu has been applied to sales, chess, football, and probably your last reorg. Here's the thing. Most of it reads like common sense. Know your enemy. Know yourself. Don't pick fights you can't win. Thanks, coach. I recently came across some analysis that changed how I read it. When it was written, that kind of common sense was anything but common. ... read more.

• October 28, 2026

By Ken Phelan, Posted in Security

I've been reading about drones. I recommend it, in the way I'd recommend a horror movie. Here's the short version. In Ukraine right now, drones cause 70 to 80 percent of all battlefield casualties. Not artillery. Not tanks. Quadcopters. Russia claims production rates approaching seven million of them a year. Ukraine builds four million. The drone that's winning the war costs roughly a thousand dollars and kills a five-million-dollar tank. The most advanced militaries on earth spent eighty years and trillio... read more.

• October 14, 2026

By Ken Phelan, Posted in Security

Sixteen months ago, I wrote about a fort. Fort Pulaski was state of the art in 1847. Eleven-foot walls, an eight-foot moat, and a full mile of open water between it and any ground an army could stand on. Then the Union showed up with rifled cannons nobody had planned for, and thirty hours later it was over. The lesson is that innovation favors the attacker, and that the right posture for a defender isn't prediction. It's humility. I closed that piece with one word. Resiliency. That's a fine word. It's a... read more.

• October 01, 2026

By Ken Phelan, Posted in Security

On a Saturday in late September, we patched our remote-access gateways. Routine stuff. A vendor had published fixes for two critical vulnerabilities, CVE-2026-88771 and CVE-2026-88772, and we pushed the fixed build to both nodes that afternoon. Ten minutes of downtime. Nobody noticed. About 23 hours later, the attackers showed up. Some background. These two bugs weren't new to the attackers. They were already being exploited as zero-days before the vendor published a fix. The bad guys had a head start. Th... read more.

• September 30, 2026

By Ken Phelan, Posted in Infrastructure, Security

This post was AI-assisted — researched and drafted with Claude, which should surprise exactly no one given who I am. The arguing and editing are mine. If it's wrong, blame me, not the machine. AI is raging in your organization right now. Not piloting. Not "under evaluation by a cross-functional committee." Raging. Every employee has tried it, most of them are using it daily, and the results look like every other distribution of human performance you've ever seen. A bell curve. Let me walk you throug... read more.

• September 16, 2026

By Ken Phelan, Posted in Infrastructure, Security, Support

A few weeks ago I wrote a post called "It's Not the Model." The short version: frontier AI is finding vulnerabilities at industrial scale, the capability will land on every platform eventually, and the scarce resource isn't the model — it's the ability to absorb what the model finds. The reactions came in two flavors. Half the room heard "the sky is falling." The other half said "the sky was always falling, why are we talking about it now?" Both halves are wrong, and it's worth being precise about w... read more.

• September 03, 2026

By Ken Phelan, Posted in Security

You've sat at this dinner. Eight security leaders around a table, good wine, better steak, and a conversational register I've come to think of as the auditor voice. Everyone has a mature program. Everyone's board is engaged. Everyone is "well positioned" on AI. By dessert you start to wonder whether your dinner companions are interviewing for their next role or rehearsing for their next examination — because nobody talks like that to people they trust. Here's the thing: I don't blame them. The perfo... read more.

• August 03, 2026

By Ken Phelan, Posted in Infrastructure

Everyone wants to talk about AI. Nobody wants to talk about the thing that's going to determine whether AI pays off: your data. Here's the uncomfortable truth I keep running into with clients. The models are fine. The models are, frankly, astonishing. If your AI initiative fails, it almost certainly won't be because the model wasn't smart enough. It will be because the model couldn't get to your data, or because getting it there cost more than the value it created. The Access Problem We spent the last fi... read more.

• July 22, 2026

By Ken Phelan, Posted in Security

Last night I had the privilege of introducing Check Point's Dan Taney to a room full of New York CISOs. Preparing that introduction sent me down a memory lane that turned out to be less about nostalgia and more about strategy. I want to share some of it here, because the story of our oldest partnership says a lot about how Gotham thinks about technology — and about what's coming next. The Original Partnership Myself and the rest of the Gotham leadership were Check Point partners from the beginning.... read more.

• July 16, 2026

By Ken Phelan, Posted in Infrastructure

So anyway, let me tell you about the robots. In 1950, Detroit employed over 220,000 auto workers. Good union jobs. Good wages. By 1970, half of them were gone. Not to Mexico. Not to China. To robots and assembly line automation that simply didn’t need much human labor. By 1982, another 400,000 jobs disappeared in just four years. Cities hollowed out. Communities devastated. Here’s the part that surprised me. Cars didn’t get cheaper. All that productivity. All that automation. A robot-ho... read more.

• May 21, 2026