Judgement Over Noise
Notes from a practicing CISO on risk, restraint, and what actually works
I’ll start with the obvious. Yes, the brand name is intentional.
The Hipster CISO isn’t about style or provocation (or trying to be clever for its own sake). It’s simply how I think about the role as a Chief Information Security Officer. I value true judgment over noise, and I’m far more interested in results that hold up under scrutiny than in activity that just looks good on paper. This Substack is where I put that thinking down, without smoothing the rough edges or pretending everything is neatly resolved. Let’s be honest, it definitely is not.
I’m writing for two reasons. First, I needed a space to think and grow (as a leader, and honestly as a person). Second, cybersecurity has become very good at narrating itself and much less disciplined about asking whether it’s actually working. Boo. Hiss. We re-produce (yes, that emphasis is intentional) artifacts, maturity language, and broadly agreeable stories, but we spend far less time examining effectiveness, trade-offs, or whether any of this is materially changing enterprise risk. I’m not particularly interested in preserving that dynamic.
Why “Hipster” Actually Matters
The term fits because it implies intentionality.
It rejects mass production in favor of precision (and yes, I am looking directly at you, AI-musing-generation experts). It favors quality over volume. I will question all defaults instead of inheriting them because “that’s how it’s always been done.” That just feels like nails on a chalkboard just writing it down.
This won’t be a feed of hot takes. It’s going to be a working notebook. Take it or leave it (and that’s perfectly okay).
Some of what shows up here will read like internal strategy memos. Some of it will come from board questions I didn’t have clean answers to at the time. There will be positions I hold with conviction, and others I’m still pressure-testing (or actively developing while I’m writing). The structure will vary, but the underlying premise won’t: cybersecurity is a business function of trust, and it should be governed with the same rigor as capital, safety, or strategy.
I’m not here to sell tools, validate orthodoxy, or soften conclusions for broader public appeal and discourse (although everyone’s voice always matters). If something is widely practiced but simply ineffective, I’ll call it out. If the data is inconclusive, I won’t pretend otherwise or shy away from saying so. I like data. I trust it more than most narratives.
This Substack fits because it reflects how I approach the work, the role, and life in general, to be honest. I’m selective, intentionally and by design. I care far less about how mature a program sounds than how it performs when something actually breaks.
How to Read This All
Read this the way you’d read something written by a peer who has nothing to sell and no interest in oversimplifying the work.
You don’t need to agree with everything here. In fact, disagreement is often a sign the writing is doing its job. If what you’re after is comfort, consensus, or the familiar “influencer” calls-to-action that are everywhere today, this may not be the right place. I wish you well regardless.
If you’re interested in sharper thinking about cybersecurity as governance, as leadership, and as an enterprise discipline that actually earns its seat at the big kid’s table, then you’re exactly who this is for.
Welcome to The Hipster CISO.
