Security Without Pessimism: Shadow IT – When Convenience Becomes a Security Risk

The Shortcut That Became the Standard

We’ve all done it.

You’re trying to get something simple done, but the company’s “official” tool takes six steps and two approvals just to open a project. So, you find a better one, quicker, cleaner, easier.

Maybe it’s a shared Google Sheet, a new messaging app, or some AI productivity tool that actually works. It saves you time, gets results, and honestly, no one seems to mind.

That is, until someone finally notices.

That’s Shadow IT, the silent, well-intentioned workaround that slowly turns into a security liability.

The issue isn’t carelessness; it’s the drive for efficiency.

The Anatomy of Shadow IT and How It Slips Through

Shadow IT doesn’t begin as an act of rebellion. It starts as a way to get things done.

Teams feel pressure, tools are slow, and company processes can’t keep up. So, someone tries a new tool that bends the rules, just for this one time.

That quick fix gets shared with others and soon becomes the usual way of doing this.

Before long, company data is moving through several tools that no one has officially approved:

Free cloud drives with no encryption.
Personal accounts are used for client data.
Messaging platforms without audit trails.
Chrome extensions quietly sync user info to external servers.

It’s not done out of malice; it’s just human nature. People pick what helps them get the job done. But each time we choose convenience over control, we lose sight of what’s happening.

Why Good People Go Rogue

Most shadow IT isn’t about breaking rules. It’s about finding better ways to work.

People want to do their jobs well. When approved systems slow them down, they look for alternatives. This creativity isn’t careless, but it can still be risky.

Most people don’t focus on compliance when facing a tight deadline. They focus on getting results.

Here’s the problem: attackers know this. They rely on busy teams taking shortcuts, creating unmonitored accounts, or storing data in places that go unnoticed.

Shadow IT doesn’t look like rule-breaking. It looks like taking initiative.

When Visibility Vanishes

Each unapproved app creates another potential risk.

Security teams can’t track data, fix vulnerabilities, or control access. Soon, they may not even know what needs protection.

If something goes wrong, you can’t protect what you can’t see. A hacked third-party app or a compromised account can quietly put the whole system at risk.

Shadow IT isn’t a single big mistake. It’s many small, hidden problems. By the time someone notices, it’s often too late to trace the cause.

Balance Control with Capability

The solution isn’t to make things stricter. It’s to make official tools easier to use.

Security should support people in their actual work, not just follow what policy says.

Here’s what helps:

Simplify the approved stack. If it’s painful to use, it’s already compromised.
Create a “request to innovate” process. Let employees suggest tools safely.
Shadow IT discovery audits. Not witch hunts — open conversations.
Default to transparency. Make it normal to say, “I’m testing this app” without fear.

The aim is partnership, not strict control. If security punishes creativity, people will just hide what they’re doing. Problems will still find a way through.

Building Trust Around Tools

You can’t get rid of Shadow IT by being strict. The only way is to build trust instead of secrecy.

If people think speaking up will get them in trouble, they’ll stay silent. But if they see it as a chance to work together, you’ll know what’s really happening.

The best workplaces see curiosity as a strength, not a risk. Security and innovation aren’t enemies; they work together toward the same goal.

Final Thought

Shadow IT isn’t caused by bad people. It happens when good intentions don’t fit with strict systems. For security to keep up with creativity, it needs to act as a guide, not just a gatekeeper.

That’s not being pessimistic. That’s reality and an opportunity to get better, together.

The Art of Cyberwar | Part III | Attack by Stratagem

The principle:
If you know the enemy and know yourself, you need not fear the result of a hundred battles. Sun Tzu – Chapter III

Strategy vs. Stratagem

A strategy is designed for longevity, while a stratagem addresses immediate challenges. Strategy anticipates years ahead to foster resilience. Stratagem focuses on the next breach, exploit, or distraction.

Within cybersecurity, strategy encompasses architectural design, layered controls, validated incident response plans, and a culture prepared to act decisively during crises. Stratagem represents the attacker’s tools, such as persuasive emails, covert code injections, or precisely timed physical penetration tests.

Both approaches are powerful, yet each possesses inherent limitations.

The Modern Battlefield: Fluid and Fractured

The threat landscape evolves continuously. Traditional boundaries are replaced by cloud environments, API vulnerabilities, and interconnected third-party networks. Security architects must prioritize adaptability and fluidity over static defenses to effectively mitigate risks.

Zero Trust principles, continuous validation, and integrated security practices throughout the development lifecycle enable proactive identification and mitigation of vulnerabilities prior to production deployment. In an environment where compromise is presumed and rapid response is critical, these measures are indispensable.

Effective defenders adopt a proactive stance. They anticipate adversary actions, analyze behavioral patterns, and design systems to adapt under attack rather than fail.

Attack by Stratagem: The Psychology of Exploitation

Major breaches often originate through psychological manipulation rather than technical flaws. Techniques such as phishing, vishing, and deepfakes exploit cognitive vulnerabilities to diminish user awareness. This approach mirrors historical propaganda methods, where controlling perception leads to controlling behavior.

While governments previously leveraged headlines and radio broadcasts, contemporary attackers exploit digital interfaces such as login pages and hyperlinks. Both strategies depend on user fatigue, habitual behavior, and misplaced trust. If users believe a fraudulent login page is legitimate, they inadvertently compromise security.

Similarly, if citizens equate fear with patriotism, they may relinquish critical judgment in favor of perceived safety. As Ben Franklin observed, individuals who prioritize temporary safety over essential liberty may ultimately forfeit both: “Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety.“

This tactic operates effectively across a spectrum, from individual email inboxes to broader ideological movements.

The Architecture of Awareness

A resilient security architecture reflects the characteristics of an aware and vigilant mindset.

Network segmentation limits the blast radius. Application hardening predicts misuse before it happens.

Firewalls and Security Information and Event Management (SIEM) systems provide the critical, irreplaceable resource of time.

Knowing your environment is knowing yourself.

Without a thorough understanding of all dependencies, exposures, and behavioral patterns, it is impossible to detect significant changes or anomalies. The same principle applies at the national level: when societies cease to critically evaluate their narratives, division and deception proliferate with ease.

Propaganda Built Into the Code

James Montgomery Flagg, I Want You for U.S. Army, 1917, collection of Chip and Carrie Robertson, photo by Robert Wedemeyer — James Montgomery Flagg, *I Want You for U.S. Army*, 1917, collection of Chip and Carrie Robertson, photo by Robert Wedemeyer

From Woodrow Wilson’s Committee on Public Information to the televised theater of Desert Storm, America learned how framing shapes belief.

Attackers apply similar principles, constructing their deceptive tactics by exploiting established trust.

Deceptive login pages replicate corporate portals, ransomware communications adopt professional language, and deepfakes are crafted to appear and sound authentic.

The primary threat is not the attack itself, but the absence of awareness regarding potential dangers. Stratagem prevails when critical scrutiny is abandoned.

Reverse Engineering the Present

Post-incident analyses consistently reveal that warning signals were present before breaches. Although alerts, logs, and telemetry data were available, they did not translate into actionable understanding.

Visibility does not equate to genuine situational awareness.

Historical events reinforce this observation.

The United States has engaged in conflicts based on incomplete or inaccurate information, often mistaking perception for certainty.

In both cybersecurity and geopolitics, failure frequently results from conflating raw data with meaningful insight.

Understanding adversaries requires effective intelligence gathering, including threat hunting, reconnaissance, and red-team exercises.

Self-awareness in cybersecurity necessitates discipline, such as maintaining asset visibility, ensuring policy integrity, and sustaining composure during operations.

A deficiency in either area enables adversarial stratagems to succeed.

The Quiet Defense

The most robust networks, analogous to resilient individuals, operate discreetly.
They do not engage in ostentatious displays; instead, they maintain a constant state of preparedness.

Their resilience is embedded within their structural design rather than expressed through rhetoric.

Authentic resilience does not stem from more active dashboards or faster technical tools. Resilience is rooted in organizational culture, situational awareness, and a humble approach. It is defined by the ability to learn, adapt, and respond more rapidly than emerging threats.

Cybersecurity, akin to statecraft, is a continuous endeavor to prevent breaches. Success is achieved not by engaging in every conflict, but by anticipating and neutralizing threats before they materialize, thereby securing victory without ever having to fight. Bringing us full circle back to understanding the fundamental nature of the original principle: If you know the enemy and know yourself, you need not fear the result of a hundred battles.

Top 1%…at something

Grammarly sent me a little “you might have a problem” email earlier this week.

Apparently, I’ve written over 900,000 words in the last five weeks. They claim it’s more than 99% of users, with more unique words than 99% of them too. I don’t know how that’s true, but I definitely have been writing a lot lately. I had no idea it was even close to that much.

It’s both kind of cool and kind of hilarious. Why? Because it wasn’t part of a strategy, a streak, or even a goal. It just came from putting in the writing reps. One sentence, one section, and one page at a time.

I’d love to say it’s all poetry and brilliance. But it’s hardly that. It’s been mostly retelling of long hours coaching, martial and security strategies and the kind of sentences that get rewritten three or four times before they sound right.

Still, I’ll take it.

Some of it’s for the book. Some of its old stories I’m finally writing down. Some of it’s heart-wrenching, some of it’s about training, traveling, coaching, fighting, or just trying to make sense of the thoughts that appear between deadlifts, dog walks, deep in the mountains or just walking into the office.

It reminded me of something George Washington once said:

“To be prepared for war is one of the most effective means of preserving peace.”

Sometimes the work is the preparation. And sometimes the work is the peace. Not trying to be prolific, just consistent.

Keeping the standard high, even when no one’s watching.

So, here’s to showing up, stringing some stories together, and hoping at least a few of them land where they’re supposed to.

Now, back to work.

No More Macro Mayhem: How to Hit Your Numbers Without Losing Your Mind

After years of lifting, training, and meeting real-life performance demands, you realize your nutrition plan shouldn’t feel like another workout. But for many people, it turns into a tracking obsession, a spreadsheet habit, or a source of stress or anxiety every time you eat.

Let’s change that.

Why macros matter, but not how you think.

Macronutrients (protein, carbs, and fats) are the foundation of performance. They help your muscles rebuild, maintain hormonal balance, and support the overall recovery process. But knowing about them doesn’t mean you have to let them control you.

As the saying goes, precision doesn’t mean perfection. It means having a system. If you want to train hard and stay healthy for years, your nutrition shouldn’t wear you out mentally. It should feel natural, not like a burden.

Three Rules to Keep It Simple and Consistent

In the Beginning, Pick Your Baseline and Repeat It
Select one meal, either breakfast or lunch, that aligns with your nutrition goals and fits your daily routine. Use the same amount of protein, carbohydrates, and fat each time. If keeping it simple helps, don’t worry about making it exciting. Simple meals build structure, and structure leads to consistency.

This meal becomes your anchor, helping you stay on track. After week one, you can start making small changes to keep your meals interesting while still keeping things simple.
When Portioning, Simply Use Visual Portion Anchors
Instead of chasing macros with a food scale, use your hands as portion tools:
- Protein = palm of your hand
- Carbs = cupped hand
- Fats = thumb or small handful
  
  This method works for everyone from tactical athletes to Olympic weightlifters and CrossFit competitors. It’s not about being exact with every number. It’s about enjoying your food and reaching your goals by being consistent and making steady progress each day.
Make Tweaks with Purpose, Not Panic
Most people make changes too soon out of worry. Try not to do that. If your training feels off or you’re hungrier than usual outside of workout times, make minor adjustments instead: add +5% protein. +10% carbs. Be sure you’re consuming the bulk of your carbs around your training window.

Here’s a bonus tip: Start by keeping notes. Each week, look back, notice any patterns, and make changes with confidence. Being consistent and clear is better than chasing new trends or getting distracted by outside opinions.

What Gets In the Way

Let’s be honest: people don’t miss their macros because they’re lazy. It happens because life gets busy, maybe you didn’t sleep well, your kids are sick, your workout got delayed, or work meetings piled up.

That’s why I follow a simple rule: plan your meals for the life you really have, not the one you wish you could organize. If your plan falls apart when things get unpredictable, it needs to be stronger. Don’t stress—just adapt and keep going.

That’s where coaching and real-world experience make the difference.

The Coach’s Corner

I’ve seen this happen with everyone I’ve coached—military members, athletes, and in my own nutrition journey, even while running a Paleo meal prep business. I always try to share these ideas and show people how to cook good food that supports real performance. The athletes who succeed over time don’t eat perfectly; they eat well and stay consistent. They build habits, rely on routines, and make their food work for them.

This Week’s Action Plan

Anchor a meal: Pick one go-to meal that hits your macros and repeat it 4–5 days this week.
Use your hands: Apply the visual anchor method to every other meal.
Track with context: Pick one training day and one rest day to log. How did you feel? What did you eat? Did it support recovery?
If necessary, adjust just one thing next week based on performance, energy, or hunger cues.

Final Word

This is about fueling your performance without burning out. Your training needs clarity, and your life needs structure. Eating well and hitting your macros shouldn’t feel like a burden. It can be the steady, powerful engine that keeps everything running smoothly in the background.

Try these strategies and let your nutrition support your best work, both in the gym and in your daily life.

Security Without Pessimism: Why “Just One Click” Can Still Break Everything

The Myth of the Harmless Click
It’s late on a Friday afternoon. You’ve taken back-to-back phone calls, your inbox is overflowing, and your caffeine is slowly but surely fading. Then comes one last email. It’s something from HR about a new hire policy update.

You click, skim, and move on.

Five minutes later, that “harmless” click starts a slow-motion domino fall. Credentials harvested, tokens stolen, access expanding, all before you’ve even closed your laptop.

People think, “It was just one click.”
That’s the point. It only ever takes one.

The Domino Effect
Here’s what happens after that moment most people never see.

That fake login page doesn’t just steal your password, it grabs your session cookies, mimics your device fingerprint, and jumps the line of trust. Suddenly, it’s you logging in from a new location, sending a file, approving an invoice.

Once inside, attackers don’t move fast. They move quietly. They study your company like a playbook, structure, tone, and approval chains. The next email they send looks even more real because it’s built with your real data.

By the time anyone notices, the damage has often been done for days.

But why do we fall for it? The answer isn’t carelessness—it’s psychology.

The Psychology of the Click
No one falls for this because they’re careless. They fall because they’re human.

Attackers know when we don’t double-check: near quitting time, maybe when you’re experiencing that post-lunch carb crash, or when you’re in a rush to make that 9am meeting. All of those moments when we see what we expect to see. They don’t need to hack your brain, they simply nudge it the right way.

Speed, familiarity, and trust are their sharpest weapons, which is why “training” alone doesn’t solve the problem. Awareness isn’t a habit. The mind knows better, but the hand clicks first.

How Attackers Exploit Normalcy
Modern phishing doesn’t seem sketchy; it seems routine.

They copy internal phrasing, familiar names, work to perfect internal branding. The trick isn’t panic anymore, it’s comfort and familiarity.

Common triggers:

“Quick update before the weekend.”
“Need approval by end of day” or “close of business.”
“Can you confirm this invoice?”

Nothing dramatic. That’s the point. The hook isn’t fear, it’s familiarity.

How to Build a Click Buffer
You can’t eliminate every threat, but you can slow the chain reaction.

Build a Click Buffer. Think of it as a two-second pause that keeps good habits automatic:

Hover before you click. Make it reflex.
Check the sender domain. If it looks almost right, it’s wrong.
Stop treating “urgent” as a priority. Urgency is a tactic, not truth.
Ask IT. They’d rather you check 100 false alarms than clean up one breach.

A brief pause can equal a big payoff. Security starts with seconds, not software.

Culture Over Blame
Here’s where most companies stumble: they turn mistakes into shame. Someone clicks a bad link, and suddenly they’re the subject of the next slide in “staff security awareness training.”

That doesn’t build security, it builds silence.

A healthy culture rewards curiosity. If people feel safe saying, “Hey, I think I messed up,” the damage stops faster, every time.

You can’t stop every click. However, you can build a team that identifies, shares, and learns from mistakes before they spiral out of control.

Final Thought
The real security upgrade isn’t another tool or rule to apply, it’s simply learning to breathe and take a little extra time to pause before you click.

One breath before the click. One second to hover over the link.
One habit that keeps the rest intact.
That’s not fearmongering.
That’s just good hygiene.

If you found this helpful, please share it with your team or reflect on your own scanning and clicking habits. Security is a team effort and every small pause makes a difference.

The Art of Cyberwar | Part II | Let Your Great Object Be Victory

The principles:
“In war, let your great object be victory, not lengthy campaigns”…because “There is no instance of a country having benefited from prolonged warfare.”
— Sun Tzu, The Art of War, Chapter II

The Art of Cyberwar -- Part II -- Be Wary of Lengthy Campaigns

Historical precedent demonstrates that nations failing to adapt are often used as cautionary examples. Despite significant resources, the United States has not yet overcome this strategic challenge.

From Vietnam to Afghanistan, the United States has exemplified Sun Tzu’s warning by conflating endurance with strength and persistence with strategy. When military presence supersedes the objective of victory, campaigns extend beyond their intended purpose, resulting in significant human and material costs.

The Illusion of Victory

Following President George H. W. Bush’s declaration on March 1, 1991, that the United States had overcome the ‘Vietnam syndrome,’ national sentiment was celebratory. The Gulf War was conducted rapidly and with precision, widely broadcast as evidence of renewed national confidence. The conclusion of the Cold War was perceived as a triumph for democratic governance.

However, this perceived redemption represented a recurrence of previous strategic errors. The primary lesson of Vietnam—the futility of engaging in conflict without a defined objective—remained unheeded. Demonstrating rapid military success led to neglect of the risks associated with protracted engagements lacking clear victory conditions or exit strategies.

In subsequent decades, this hubris manifested in new conflicts. The invasions of Iraq and Afghanistan were initially framed as missions of defense and liberation, but evolved into prolonged operations characterized by strategic inertia. Between January 1968 and January 2022, the United States expended approximately $41 trillion on regime-change wars, supporting unstable governments, and reconstructing nations without explicit local consent.

When the conflict concluded in Kabul in August 2021, the resulting images closely resembled those from Saigon in 1975: helicopters evacuating personnel, abandonment of allied partners, and governmental collapse returning control to the previously ousted regime.

Two wars. Two generations. One unlearned truth:

“Contributing to maintain an army at a distance
causes the people to be impoverished.”

The resulting impoverishment extended beyond material losses to include diminished clarity, discipline, and strategic purpose.

The Cost of Long Wars

Sun Tzu recognized that prolonged conflict leads to internal deterioration. Geographic and temporal distance not only depletes resources but also impairs strategic perception.

Extended campaigns obscure strategic objectives and make it difficult to define victory when mere survival becomes the primary focus.

This confusion often results in a detrimental shift from strategic planning to operational maintenance.

The Cyber Parallel

A similar pattern is evident in contemporary cybersecurity. Prolonged defensive operations manifest as alert fatigue, excessive expenditures, and staff burnout. Continuous patching, monitoring, and incident response create an environment of persistent engagement. While terminology evolves, the underlying strategic mindset remains unchanged.

Cybersecurity teams often become engaged in repetitive activities, addressing recurring issues through marginally varied approaches without achieving lasting resolution.

This situation represents the cybersecurity equivalent of protracted military engagements, often referred to as ‘forever wars.’ Effective leaders, including Chief Information Security Officers (CISOs), recognize the importance of strategic restraint.

It is neither feasible nor advisable to attempt to defend all assets indiscriminately. The primary objective is not comprehensive awareness but rather targeted precision.

Security efforts should prioritize critical assets and aim to resolve threats efficiently rather than sustain ongoing conflict.

“The leader of armies is the arbiter of the people’s fate.”

Within organizational contexts, this leadership role may be assumed by a security architect, team leader, or any individual responsible for directing security resources. The fundamental responsibility remains the protection of the enterprise.

Victory Over Attrition

The primary cost of protracted conflicts, whether conventional or digital, is cumulative exhaustion. Achieving victory requires recognizing the appropriate moment to cease operations, consolidate gains, conduct assessments, and facilitate recovery.

Regardless of the domain, whether physical or digital, conflicts that lack a definitive conclusion cannot be considered genuine victories.

Once again, highlighting the timeless nature and importance of imbibing this story’s principles: “In war, let your great object be victory, not lengthy campaigns…”
because “There is no instance of a country having benefited from prolonged warfare.“

Dispatches From The Blue Ridge

The day began like the perfect hymn for the weekend. First light spilling over the ridgeline. Fog blowing across the mountains like they’re alive and breathing. The whole place is brought to life by the energy of the mountains, the wind, the sun, and the sky.

You can hear a waterfall in the distance, as steady as time itself.

Later, a violet sunset arrives as the last of the day’s light folds into the night.

Then, at nightfall, the only things that remain are the ghost stories and the million stars in the sky, like a thousand bridges of light overhead, leading some old, lost spirits home over the horizon.

The 5 Biggest Meal Prep Myths and What Actually Works for Real People

Meal prep gets talked about so much these days, you’d swear it’s a personality trait. It’s always rigid, joyless, and maybe just a little smug. But the truth is, prepping food isn’t about discipline for its own sake. It’s about simplifying the week so you can think less about logistics, saving money, and staving off adverse health effects, and more about living your life.

While you’ll often see phrases like “may help” or “might improve” online, real data and everyday experience show what actually works. Here’s what makes a real difference for people like us.

Myth #1: “Meal prep means eating the same thing every day.”

Reality: Meal prep doesn’t mean you have to eat chicken and rice every day until you’re sick of them. The real goal is to make healthy choices easy and convenient.

Try prepping ingredients instead of full meals. Grill or roast some proteins, cook a few types of carbs, and chop up veggies. Then, mix and match them throughout the week—maybe smoked salmon over greens one day, steak and rice another, or yogurt with fruit when you need something quick.

What “the science” says: Research from the International Journal of Behavioral Nutrition and Physical Activity found that people who plan their meals tend to have more diverse diets — not less. It’s the planning that makes variety possible, not spontaneity.

Myth #2: “Prepping takes too much time.”

Reality: Spending a few hours on Sunday or Saturday can save you from stressful evenings all week. Even just washing produce, boiling rice, or portioning fruit ahead of time can make your weekdays much easier.
And it’s not just about time. People who spend even 30–60 minutes a day preparing food eat more vegetables and fruit (University of Washington research, 2014).

The time’s going somewhere either way, you can spend it prepping intentionally, or you can spend it waiting in drive-thrus.

Myth #3: “Meal prep is only for people trying to lose weight.”

Reality: That idea is just a marketing myth. Meal prep isn’t only for losing weight. It helps you avoid making poor choices when you’re hungry and supports your long-term health.

Sure, portion control helps. But more importantly, prep stabilizes your energy and makes fueling performance automatic. Whether you’re lifting, coding, or commuting, your brain and body both need steady inputs.

Home-prepped meals consistently come in lower in sodium and saturated fat, not because they’re “diet food,” but because you’re in charge of the ingredients.

You’re not dieting; you’re planning to succeed, not to fail. When in doubt, always rely on PPP, proper prior planning, and it’ll save you in countless scenarios.

Myth #4: “It’s cheaper to just grab takeout.”

Reality: The numbers don’t lie. Data from the American Journal of Preventive Medicine shows that people who cook at home spend significantly less on food than those who eat out. Prepping helps you shop with purpose, so you buy only what you need. You waste less food and make your ingredients go further.

Pro tip: Using convenience items still counts as meal prep. Things like pre-washed greens, frozen veggies, frozen fruits, or rotisserie chicken can make things easier. Being efficient is smart, not cheating.

Myth #5: “Healthy meal prep means going ‘Paleo,’ ‘keto,’ or you’re “cutting carbs.”

Reality: Restrictive eating styles burn people out. The goal is consistency, not purity. You don’t have to eliminate carbs, especially if you train. Always remember, persistence over perfection.

Your brain and body work best with carbs. Foods like fruits, vegetables, potatoes, and white rice help you perform and recover, especially if you’re working out.

Coach’s Note: We eat well today for optimal performance tomorrow. — **Coach’s Note:**
We eat well today for optimal performance tomorrow.

Whether your training is on the mats, in the gym, or at your desk, food is fuel, not a moral test.

The Bottom Line

Meal prep isn’t about being perfect, it’s about being consistent. It’s a simple way to get back your energy, time, and control in a world full of distractions. Eat well, keep your plans simple, and stick with what works.

Progress comes from following through, not from always trying something new.

Multi-Factor Authentication: Boring, Annoying, Essential

In cybersecurity, we get excited about new technologies like AI, zero trust, and quantum encryption. But ask any practitioner what quietly stops the most breaches day to day? It’s still MFA.

Multi-Factor Authentication may not be exciting. It can slow people down and sometimes feels awkward. Even so, it remains one of the best ways to stop credential theft, which is the most common way attackers get into any network.

Why MFA Matters

• Passwords are weak. People reuse them across accounts, attackers buy them on the dark web, and “123456” still shows up in breach data.
• Phishing is effective. Users still click links and enter credentials. MFA blocks stolen passwords from being enough.
• Attacks are automated. Bots hammer login pages at scale. MFA breaks that automation by forcing a second factor.

Despite everything we know, MFA is still the easiest and most effective step in cyber defense. It often makes the difference between stopping an incident and having to respond to one.

The Pushback Problem

When we first rolled out MFA our district, the resistance was loud.

“It’s annoying.”
“It slows us down.”
“We don’t have time for that.”
“Why do I need this if I’m just checking email?”

At first, security changes can feel like a big hassle for everyone, whether you’re a teacher, technician, or leader. But a few seconds of extra effort can save us from days or even weeks of problems.

To make sure everyone accepted MFA, we took our time and built support step by step:

• Continuous staff education. Regular updates explained the “why” behind MFA, not just the “how.”
• Knowledge-base articles gave our help desk a clear playbook, no scrambling when someone was locked out or confused.
• Anticipating questions became part of the rollout strategy. From custodians logging into shared workstations to the superintendent approving district-wide communications, everyone got personalized guidance.

We kept the message clear: MFA is not a burden. It’s part of how we protect our entire staff and precious student PII, and PHI data. We aways have to remain FERPA, COPPA, CIPA, and PPRA compliant.

Over time, the complaints faded. Now, using MFA is second nature. It’s simply part of our routine.

The Fix

• Enforce MFA on all critical systems.
• Use phishing-resistant methods (authenticator apps, hardware keys) and worst-case scenario SMS.
• Train users that a few extra seconds of friction is the cost of resilience.

The Parallel

Using MFA is similar to wrapping your hands before boxing. It might seem tedious when you’re just getting started, but it protects you. If you skip it once, you might be fine, but skip it again, and you risk real trouble.

Security, like weightlifting, CrossFit, martial arts or meal prep it works best when the basics become instinct.

Again, MFA is boring. But, it’s also one of the most powerful shields you have.

The Art of Cyberwar | Part I | The Illusion of Truth

The principle:
All warfare is based on deception. —Sun Tzu

In warfare, there’s a certain irony in how often truth becomes a casualty before the first shot is ever fired. As an American, that line from The Art of War has always carried extra weight. Our history is full of moments when deception wasn’t just a tactic on the battlefield; it was the spark that lit the fuse.

From the smoke and mirrors of the Spanish-American War to the Gulf of Tonkin and the blurred motives of the Gulf Wars and the Global War on Terrorism, we’ve seen how perception shapes permission. Wars don’t always start because one side is stronger; they start because one story feels true enough to believe.

And since “All warfare is based on deception,” Sun Tzu went on to say:

When you’re able to attack, you must appear unable. When using our forces, we must seem inactive. When we are near, we must make the enemy believe we are far away. When we’re far away, we must make him believe we are nearby.

We must hold out bait to entice the enemy and then crush him. If he is superior in strength, evade him. If your opponent is overconfident in nature, seek to provoke him. Pretend to be weak, so that he may grow arrogant and attack when he otherwise wouldn’t. Attack him where he is unprepared, appear where you are not expected. If he is trying to take rest and recover, give him no rest. If his forces are united, divide them.

The general who loses a battle has made only a few calculations beforehand. Thus, many calculations lead to victory, and making only a few calculations ensures defeat. By paying attention to these points, I can foresee who is likely to win or lose.

Deception as Strategy

The principles articulated by Sun Tzu extend beyond the battlefield to broader strategic contexts. His observations highlight the value of misdirection for leaders and strategists. The objective is not to create disorder, but to control perception and attention. In both conventional warfare and digital security, success frequently depends on understanding the adversary’s perception of reality. This principle underpins the effectiveness and prevalence of social engineering tactics.

Contemporary deception strategies have shifted focus from traditional military maneuvers to achieving information dominance. Modern tools include manipulated narratives, deepfakes, phishing campaigns, propaganda, and misinformation. These methods target cognitive processes rather than physical harm. Once individuals accept misinformation as truth, further manipulation becomes significantly easier. The Committee on Public Information, the United States’ World War I propaganda agency, exemplifies institutionalized information control.

Cybersecurity’s Ethical Deception

In cybersecurity, deception is employed with the intent to enhance defense mechanisms. Techniques such as honeypots attract attackers, sandbox environments facilitate malware analysis, and red team exercises simulate adversarial tactics to maintain robust security postures.

In this context, deception functions as a defensive measure rather than an offensive tool. It is utilized to identify vulnerabilities rather than to exploit them. The underlying principle that can mislead a nation may, when applied ethically, serve to protect it. The distinction lies in the intent: defense and awareness as opposed to manipulation and illusion.

Both approaches depend on psychological insight and require strategic foresight. However, only defensive deception is fundamentally grounded in ethical integrity.

The Martial Mirror

Martial artists understand deception in its purest, most physical form. A feint isn’t a lie, it’s a question. In Wing Chun, they’re called “asking hands.” You draw your opponent’s attention, focus and/or movement one way to reveal where they’re vulnerable. The best fighters aren’t those who hide, but those who read intent faster than it’s shown. It’s why attacks on the halfbeat are so effective. But, that’s a lesson for another time.

Cybersecurity employs similar principles. Confrontation is not always optimal; instead, threats are redirected, absorbed, or neutralized preemptively. The discipline emphasizes anticipating patterns before they fully emerge, rather than merely reacting. This approach is often described as the art of fighting without fighting.

The Modern Maxim

“Deception reveals more than it hides, it shows what we most want others to believe.”

In this context, each act of deception simultaneously reveals underlying motives, strategies, and tactics.

For those responsible for safeguarding systems, individuals, or factual accuracy, the task often begins where clarity diminishes. The primary challenge is not to eliminate deception entirely, but to recognize and understand it without compromising ethical standards.

The initial action in any conflict, whether digital, physical, or psychological, is seldom a direct attack; it is often the creation of a narrative to tell. The essential responsibility is to accurately identify threats based on objective analysis, rather than relying solely on presented information. Illustrating the everlasting importance of learning the principle of this story: All warfare is based on deception.