Blog

By Steve Gold, Posted in Security

You’re running late for an appointment. No coffee, no breakfast, the outfit is not, exactly, what you were hoping for.  You need to make up time, so you start looking for it wherever you can find it. You approach an intersection with a stop sign, glance both ways, and roll right through without fully stopping. Congratulations. You are now a GRC expert. You knew the rule. You know how to be compliant. You made a calculated decision to accept the risk anyway because the odds felt good and the pay... read more.

• September 22, 2026

By Bert Amodol, Posted in Security

There's a scene in every heist movie where the security guard stares at a bank of monitors, sipping lukewarm coffee, absolutely certain that nothing interesting is going to happen tonight. That guard is every SOC analyst I've ever met. Except now the thing sneaking past the cameras isn't a guy in a ski mask. It's a language model that can write, iterate, and adapt faster than any human red team I worked with twenty years ago. AI handed attackers a new tool and a new tempo. The real problem isn’t tha... read more.

• September 21, 2026

By Eric Corcoran, Posted in Technology Week in Review

Tuesday 9/8 CIS Safeguard 13.6: Collect Network Traffic Flow Logs https://www.gothamtg.com/blog/cis-safeguard-136-collect-network-traffic-flow-logs Wednesday 9/9 Most staffing firms match resumes to job descriptions. We match technical talent to real technical environments. Why? Staffing at Gotham isn't standalone. It's built on the same technical foundation as our Professional Services organization. Our recruiters aren't screening in a vacuum. They're backed by a team that lives inside tech stacks and... read more.

• September 18, 2026

By Ken Phelan, Posted in Infrastructure, Security

This post was AI-assisted — researched and drafted with Claude, which should surprise exactly no one given who I am. The arguing and editing are mine. If it's wrong, blame me, not the machine. AI is raging in your organization right now. Not piloting. Not "under evaluation by a cross-functional committee." Raging. Every employee has tried it, most of them are using it daily, and the results look like every other distribution of human performance you've ever seen. A bell curve. Let me walk you throug... read more.

• September 16, 2026

By Steve Gold, Posted in Security

In The Bear, every station in the kitchen has a different job, a different set of skills, and a completely different set of things that can go wrong. You do not train the pastry chef the same way you train the expeditor. You do not pull the sous chef aside to explain how to plate a salad. Everyone needs to know the basics, but the role-specific skills are what keep the kitchen from catching fire. Your security training program works the same way. What Is Conduct Role-Specific Security Awareness and Skills... read more.

• September 15, 2026

By Steve Gold, Posted in Security

In Succession, every power move and every backstab eventually came back to one question: what's on the record? When things went sideways for the Roys, the only way to reconstruct the truth was to go back to the tape. Someone, somewhere, had kept a log of what happened. CIS Safeguard 13.6 is your network's version of that tape. What Is CIS Safeguard 13.6? Network traffic flow logs are records of every connection that crosses your network. Source IP, destination IP, port, protocol, bytes transferred, timest... read more.

• September 08, 2026

By Timothy Karl, Posted in Infrastructure

Microsoft made Azure Virtual Desktop (AVD) Hybrid generally available on September 1, 2026. It lets you run desktop hosts in your own datacenter while Microsoft manages the AVD service in Azure. That’s good news if data residency, latency, or compliance rules have kept you off cloud-hosted AVD. Key Benefits Microsoft still runs the core service. You don’t manage a connection broker or gateway. Use the hardware you already have. Works with your own hypervisor or dedicated physical servers. ... read more.

• September 04, 2026

By Eric Corcoran, Posted in Technology Week in Review

Monday 8/31 Rethink Hybrid Identity: It Is Not the Destination (HYPR) Hybrid identity persists not because modern workforces require it, but because many organizations continue to support legacy applications, legacy infrastructure, legacy authorization models, and operational processes that predate cloud computing. The continued existence of those dependencies should not be mistaken for validation of hybrid identity as a long-term strategy. https://www.hypr.com/blog/rethink-hybrid-identity-it-is-not-the-... read more.

• September 04, 2026

By Ken Phelan, Posted in Infrastructure, Security, Support

A few weeks ago I wrote a post called "It's Not the Model." The short version: frontier AI is finding vulnerabilities at industrial scale, the capability will land on every platform eventually, and the scarce resource isn't the model — it's the ability to absorb what the model finds. The reactions came in two flavors. Half the room heard "the sky is falling." The other half said "the sky was always falling, why are we talking about it now?" Both halves are wrong, and it's worth being precise about w... read more.

• September 03, 2026

By Steve Gold, Posted in Security

In the 2022 Andor series, the Rebel network operates on strict need-to-know access. Operatives who break protocol lose their connection to the network entirely, not as punishment, but as operational necessity. If your credentials or your compliance are in question, the network shuts you out before you become the breach. That's exactly the model CIS Safeguard 13.5 asks you to build for your remote users. What Is Manage Access Control for Remote Assets? CIS Safeguard 13.5 is about making sure remote access... read more.

• September 01, 2026