Practical guidance based on 20+ years in security leadership and the work of taking a crypto company public.
The 5 areas that generate the most friction in Series B security diligence. What investors actually look for, and how to pass the test before they ask.
Based on 20+ investor diligence calls and the security program that took Bitcoin Depot public.
Deep dives on the topics that keep operators and investors up at night.
Most crypto companies fail SOC 2 on key management and access control — not because they're sloppy, but because the standard was written for SaaS, not digital assets. Here's how to evaluate whether your auditor understands your business model before you waste $30K.
Read more →A founder told me his Series B term sheet was delayed 6 weeks because of one security question. Not a breach. Not a failed audit. Just a question he couldn't answer well. Here's what it was, and how to make sure you're not the next story.
Read more →NYDFS Part 500 was updated in 2023. Most companies I talk to are still operating under the 2017 version. The biggest change: the "covered entity" definition now captures companies that "control" or "maintain" nonpublic information of New York residents. If you have even ONE customer in New York, you need to read this.
Read more →Most tabletop exercises are theater. The team sits in a room for 3 hours, checks a box, and goes back to work. Here's the format I've used at the public company level — including the one scenario that reveals whether your incident response plan is real or fiction.
Read more →I reviewed the AI governance policies of 12 FinTech companies last quarter. 11 were copy-paste jobs from a law firm template. Only one was actually usable. The difference? It answered three specific questions that boards and investors are starting to ask.
Read more →Taking Bitcoin Depot public changed our security program in ways no one warned me about. Security went from reporting to the CTO to reporting to the Audit Committee. Every incident became a potential 8-K disclosure. Here's what I learned — and what every company should do now, even if an IPO is years away.
Read more →I send one practical security briefing per month — no fluff, no product pitches, just what I'm seeing across diligences, audits, and boardrooms.
Join the List