J Wolfgang Goerlich

I’m the unflinchingly optimistic graybeard, wandering in this cyber dystopia. InfoSec, cybersecurity, futurist, strategist, chaotic good. The views expressed are my own. Sometimes humorously.
 https://jwgoerlich.com

Last Notes

2026-06-16 03:58:31 CEST

Please. Repeat after me:
AI is not an employee. AI is not a teammate. AI is not a friend.

2025-11-22 07:20:13 CET

- reply

CSRB, the NIST 800 team, CISA, ISACs for multi-state and elections. It’s a mess.
Happy to share how this is impacting local (county) governments, if that’s a route you explore.

2025-09-21 00:13:50 CEST

Most of us build controls like we’re plugging leaks in a roof. A drip here, a patch there. Before long, the ceiling looks like a quilt of yesterday’s fixes.
It works until the next storm.
But the adversary doesn’t think in leaks. They think in flow. They’re already mapping where the water will run tomorrow. If our job is just plugging holes, we’ll always be one step behind.
The shift comes when we stop seeing security as patchwork and start seeing it as plumbing. How is data flowing? Where will pressure build? Who has the wrench when something bursts?
Good security isn't reacting to breaches. Good security is anticipating how attackers will reroute around today’s controls. Our job is to channels the flow so tomorrow’s storm has fewer places to break through.
That's defensibility.
(PS: Yes, I'm doing work on my house. How did you guess?)

2025-09-18 18:18:21 CEST

InfoSec:
"Never ever click on emails, all emails are malware."
Also InfoSec:
"Check out this new security feature which provides passwordless login right from an email link."

2025-09-12 11:36:05 CEST

LOLs per Employee: a vital metric.
Shenanigans are a sign the team has sufficient energy in reserve, signaling readiness for handling emergencies and unplanned work. Play usually reflects underlying trust, cohesion, and resilience.
Encourage it.

2025-09-02 14:21:27 CEST

Give an investor three points on a graph, and they’ll plot a exponential curve. Any three points. Every time.

2025-08-07 19:14:08 CEST

Opened up Instagram to see a number of friends clustered in Las Vegas.
This is a problem. No, not because Sin City. Because Instagram apparently opted in everyone.
Turn it off under chat.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/988/603/383/604/732/original/4d4b1ac97f642e34.png

2025-06-25 18:38:39 CEST

Them: "In order to make this change, I need to verify you. I'll do this with a one-time text."
Me: Sure.
Them: "We have no phone number on file."
Me: ...
Them: "Not to worry. I'll update your account. What number would you like to use?"
#CustomerService > #Security

2025-05-15 18:57:04 CEST

We *must* get away from security which depends upon a full inventory. It was difficult back when things were mostly static and mostly ITIL. It is practically impossible at 2025 velocities.

2025-04-19 23:58:59 CEST

- reply

https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/366/869/208/114/881/original/9fda5b98b09dba2c.png

2024-10-21 01:25:26 CEST

I couldn’t solve a Captcha. I am very much human. But there’s too much visual noise.
So I screenshot the Captcha and got the answer from ChatGPT. I’m in! Modern problems, modern solutions.

2024-10-20 17:20:18 CEST

If your first thought is, “maybe they never happened because we worried,” then a career in cybersecurity might be right for you.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/340/419/534/791/007/original/18ea6b18525a26d0.png

2024-09-21 21:58:07 CEST

The Anarchist Cookbook. One of the kids brought home the Cookbook. He paid $45 for the book. Anarchy, in this economy!?

2024-09-05 01:04:12 CEST

Occam's Razor: the simplest explanation, with the fewest assumptions, is the correct explanation.
Wolf’s Electric Shaver: the silliest explanation, with the most dramatic dysfunctions, is the correct head-cannon.