Author: Matt
Overreach Is the Enemy of Resilience
History shows that the biggest threats to national security, safety, and sovereignty usually come from within. Empires, and leaders, often fail not because they are weak, but because they try to do too much, too quickly, and often end up heading in the wrong direction.
The Yalta Conference in February 1945 brought together Churchill, Roosevelt, and Stalin in an alliance of necessity. Few in the 1930s could have imagined democratic America and Britain siding with Stalin’s Soviet Union; yet necessity led to a partnership with lasting consequences.
The alliance beat Nazi Germany, but it also allowed the Soviet Union to spread into Eastern Europe, which led to the Cold War. The key takeaway: short-term use of power without considering long-term impact can resolve immediate issues but create new, lasting problems.
The same risks are present in cloud security today. Trying to do too much still undermines resilience.
Why Overreach Happens
Overreach is a common trap. If having some power is good, it’s easy to think that having more is better. In cybersecurity, this often happens because of:
- Fear of falling behind leads teams to adopt new tools without a clear strategy.
- Vendor pressure, with marketing insisting, “If you don’t have this, you’re insecure.”
- Internal signaling, where having numerous tools initially appears impressive, but problems soon emerge.
Historical Lessons: The Cost of Overreach
Germany in WWII: Too Much, Too Fast
Germany under Hitler is a classic example of overreach. In 1941, the Nazis invaded the Soviet Union. Initially, their advance was rapid, and they gained significant territory. However, German forces became overstretched, supplies dwindled, winter conditions set in, and the supply lines became unmanageable. What appeared to be a demonstration of power ultimately contributed to their downfall.
Lesson: Expansion without capacity undermines itself.
Japan: Provoking Too Many Enemies
Japan’s decision to attack Pearl Harbor in 1941 reflected a similar flaw. In pursuit of empire across Asia, Japan provoked a much larger adversary: the United States. Instead of consolidating its position, this overreach led to a conflict Japan could not sustain. Lesson: Overreaching creates adversaries you can’t manage.
The Allies: Yalta’s Unintended Consequences
Even the victors faced challenges. The Yalta alliance was necessary at the time, but also carried significant risk. By permitting the Soviet Union to expand into Eastern Europe, the Allies set the stage for forty years of Cold War tension, arms races, and indirect conflicts. Gaining power in one region led to new risks elsewhere.
Lesson: Gains made without foresight can create future vulnerabilities.
The Cost of Overreach in Cloud Security
The same dynamics play out in modern cybersecurity:
- Integration gaps: When you have too many tools, it’s like an army spread too thin—there are weak spots attackers can find.
- Alert fatigue: More dashboards overwhelm teams, dulling response rather than sharpening it.
- Diluted focus: Chasing new tools causes basics (IAM, logging, patching) to be neglected.
The main takeaway is that the paradox is that spending more and adding complexity often reduces resilience rather than strengthening it.
The Better Path: Discipline and Restraint
History points to a better approach. Resilience isn’t about growing without limits. It comes from balance, self-control, and getting the basics right.
For nations, that means understanding the limits of alliances and occupations. For cloud teams, it means:
- Focusing on fewer, stronger tools that integrate smoothly.
- Start by mastering the basics: IAM policies, patching cycles, logging, and monitoring. These may not be exciting, but they are essential.
- Resisting the urge to sprawl. Don’t buy tools or add features for the sake of appearances. Invest only where it truly adds resilience.
Closing Parallel
Yalta reminds us that even the strongest powers can make bargains that carry unintended consequences. Overreach may appear to be a sign of strength in the moment, but it often sows the seeds of weakness for the future.
In cloud security, the same is true. More tools don’t equal more safety. Complexity can backfire. Overreach creates vulnerabilities. The key lesson: resilience means mastering the essentials and exercising discipline, not doing more for the sake of it. This is as true in geopolitics as it is in cybersecurity.
Where have you seen overreach undermine resilience in your organization?
Want to dive deeper into the history and strategy behind these lessons? Here are some recommended reads:
- The Origins of The Second World War, by A.J.P. Taylor
- Depression, War, and Cold War: Studies in Political Economy, by Robert Higgs
- Churchill, Hitler, and “The Unnecessary War”: How Britain Lost Its Empire and the West Lost the World, by Patrick J. Buchanan
- The New Dealers’ War: Franklin D. Roosevelt and the War Within World War II, by Thomas Fleming
- The War That Ended Peace: The Road to 1914, by Margaret MacMillan
- Paris 1919: Six Months That Changed the World, by Margaret MacMillan
Progress Isn’t Linear, in Martial Arts or Cybersecurity
Progress isn’t linear. Martial artists learn this the hard way. One day you nail a three punch combo finished with a clavicle crushing elbow; the next, you stumble over the same movement combination you were hitting regularly just a couple days before. Some weeks, you level up quickly, while others days you’ll hit stumbling blocks. Always approach your wins and losses with the same humility.
Cybersecurity follows the same rhythm. Just as martial artists face setbacks, security professionals experience their own ups and downs. You patch systems, close vulnerabilities, and tighten configurations. Then a new zero-day vulnerability emerges, or an audit reveals previously unaddressed blind spots. It feels like sliding backward.
That slide isn’t a failure, it’s where progress truly forms.
The Myth of Linear Progress
We often imagine progress as, although slow, always moving upward. Reality is less predictable.
- Perfection Bias
We assume improvement should always feel smooth. However, mastery, in both martial arts and cybersecurity, is a jagged path. The dips are where the depth develops.
- The Comparison Trap
We see others’ highlight reels, the black belt breaking boards, or the company posting its “zero vulnerabilities” report, and mistake it for constant progress. Behind every clean result lies a mess of mistakes, patches, and failed tests. - Forgetting That Setbacks Build Strength
Regression often signals deeper adaptation in progress. In training, it’s when you refine mechanics. In security, it’s when you reinforce foundations.
Why Steps Back Matter
Plateaus and regressions aren’t detours; they’re checkpoints. They test persistence. Anyone can stay motivated when everything goes as planned; resilience forms when it doesn’t.
They reveal gaps in fundamentals. A failed pen test or misconfigured IAM or conditional access policy highlights what needs real attention. They build humility and precision. Overconfidence blinds; setbacks sharpen focus.
On the mats and in the SOC, mastery isn’t about avoiding mistakes, it’s about learning faster from them.
The Cybersecurity Parallel
You don’t know what you don’t know so every incident teaches you something you didn’t know you needed to learn. Every vulnerability scan reveals details you may have overlooked. It isn’t failure. It’s your system adapting, like a martial artist’s mind & body.
A martial artist doesn’t quit after a rough sparring session. They analyze what went wrong, refine their techniques, and return smarter & stronger. Security teams should do the same. A missed vulnerability isn’t a defeat; it’s a mirror. It can show you where your technique slipped & where to tighten your counter-offensive skills.
From the Mats to the Data Center
Both disciplines thrive on discipline, reflection, and repitition:
Training drills = Routine audits. Each repetition builds muscle memory for fighters and for security teams.
Pad work and shadow boxing = Playbooks and runbooks. Practicing in controlled settings builds confidence under pressure.
Sparring = Incident Response sims. You can’t simulate chaos perfectly, but you can train to be calm, and respond correctly, in chaos. That’s why you just keep training and doing reps over and over because each time your partner responds differently but you’re learning to respond with the correct technique every time.
Every repetition, every submission attempt, every punch, every kick, or incident response builds competence and confidence. Every CVE update, OWASP update or vulnerability scan creates visibility and awareness.
The Real Skill of a Black Belt: The Ability to Adapt and Overcome
In martial arts, the belt color doesn’t make you untouchable; it signifies you’ve learned and adapted more than others. In cybersecurity, it’s the same. The strongest organizations aren’t flawless; they’re mobile, agile and when necessary, hostile.
Adaptation beats perfection. Reflection beats reaction. Resilience beats your comfort zone. So the next time your scan lights up with new vulnerabilities or your red team exposes a blind spot, don’t get discouraged. It’s just another training session.
Final Thought
Progress, whether in close range combat or in your code, isn’t about avoiding setbacks. It’s about showing up again after them. The real win isn’t being unbreakable, it’s being unshakable.
Keep patching. Keep learning. Keep moving. Progress isn’t linear, but staying adaptive always drives you forward. Or, as it was once famously said, “Be water my friend.”
Cloud Security and Meal Prep: The Routine That Saves You When It Counts
Whether you’re a cloud engineer, a school IT lead, or just someone juggling a lot of responsibilities, you know routines matter. Here’s how a few simple habits, both in the kitchen and in the cloud, can make all the difference when things get hectic.
Meal prep can feel like a grind: chopping, portioning, stacking containers into neat rows. Yet when a demanding week hits, that fridge full of ready-made meals is your quiet victory. It’s proof that routine pays off when pressure arrives.
Vulnerability scanning and patching works similarly. It’s repetitive, rarely celebrated, and usually annoying. But consistency is what saves you during mission-critical moments, when vulnerabilities surface or threat actors strike.
The Problem with Patching
Patching never ends. There’s always another round of updates, another CVE, another “critical” bulletin. The challenge isn’t just time, it’s motivation.
- It’s endless. You finish one cycle only to start another.
- It’s invisible. No one notices the breach that never happened.
- It’s easy to delay. “We’ll patch later” often becomes “we wish we had.”
In cloud environments, the pace is faster. Systems scale dynamically, microservices update constantly, and the attack surface grows by the minute. Skipping one patch cycle is like skipping a week of prep: you won’t feel it right away, but the fallout is inevitable.
The Solution: Treat It Like Meal Prep
The way through is rhythm and habit, small, consistent actions that compound into resilience.
- Automate Where Possible
Just like batch cooking, automation saves time and reduces errors. Use tools like AWS Systems Manager Patch Manager, Azure Update Management, or Google Cloud OS Config to deploy updates automatically across fleets. Automate notifications and reporting as well, so visibility remains high without incurring manual overhead.
Pro tip: If you’re new to automation, start small by piloting auto-patching in a test environment before rolling it out everywhere.
- Schedule Cycles and Stick to Them
Create predictable patch windows: weekly for endpoints, monthly for servers, rolling updates for cloud workloads. Align these cycles with CI/CD pipelines to ensure updates integrate seamlessly with development. Repetition builds trust in the process and limits downtime surprises.
- Make It a Habit
The goal isn’t to be a hero, but to be consistent. Prep your meals each week, patch your systems on schedule, and review your process every month. Eventually, these steps just become part of your routine.
The Payoff: Prepared Beats Panicked
When a zero-day hits, the teams that patch regularly move smoothly through the chaos. Their systems are up to date, their dependencies are tracked, and their processes are tested. The rest scramble for emergency fixes while downtime bleeds into dollars.
Routine patching does more than fix vulnerabilities. It helps you stay calm when things get stressful. This steady discipline keeps your operations running smoothly, even when others are scrambling.
Final Thoughts
Security, like nutrition, doesn’t come from sudden bursts of inspiration. It comes from doing the same things regularly. The calm, controlled and protected environment you want later depends on the boring discipline you practice now.
Stay consistent, use automation thoughtfully, and patch your systems the way you meal prep: always ahead of time. This is how you keep both your systems and your peace of mind when things get tough.
Discipline Over Flash: 30 Strict Pull-Ups for Time
Most workouts have a loophole. If you know how to do them, you can kip and be done in less than a minute. Most dudes who do “pull-ups” cheat the range of motion like it’s a professional sport by never fully extending at the bottom, and/OR do NOT get their chins over the bar. But, every now and then, rules will strip everything away and reveal the raw truth.
That’s the point of this challenge: 30 strict pull-ups for time.
The rules are simple but tough:
- Must be done in sets of 5 or 10 only. No singles, no doubles, and no kipping (this time).
- NO half a$$ Pete Hegseth or RKF, Jr. reps.
- Full extension at the bottom. Elbows locked out every time.
- Chin over the bar at the top. No “almost” reps. No, “I was so close that time.”
- Discipline over ego.
My time? Watch and see.
But the question you might be asking is, “Why Does This Even Matter?”
This is more than a physical test; it’s a mindset test, like the pressure faced in cybersecurity, leadership, or life.
Here’s what the workout teaches:
- Constraints Make You Stronger
Without the rule of “5 or more reps per set,” you’d see people game the system: 30 singles, done easily, no challenge. But rules force focus. They push you past your comfort zone and into real growth.
Cloud security works on the same principle as the pull-up challenge: doing things the hard, correct way leads to lasting results. In cloud security, if you make permissions too loose or skip essential controls, it seems easier—just like doing easier pull-ups. But real security comes from applying restrictions such as least privilege, multi-factor authentication, and segmentation. These are to security what strict form is to strength: they are challenging but essential for durability.
2. Form Is Discipline
Locking out every rep is about integrity. Cutting corners in training leads to cutting corners under stress.
Cyber pros know the drill: if you skip patch cycles, code reviews, or alerts, you won’t suddenly excel in a crisis—you will perform only as well as your training prepared you. The point is: in emergencies, people don’t ‘rise to the occasion’; they revert to their standard preparedness.
3. Speed Comes From Structure
Strict pull-ups in just over 2 minutes require planning: strict adherence to set sizes, rest, and when to push or hold back.
Incident response follows the same principle: structured speed is essential. Success comes from following practiced processes, not from last-minute effort.
4. Resilience Beats Flash
Nobody remembers the person who did 20 kipping pull-ups that looked good on Instagram but didn’t count in this instance. The athletes who succeed in the gym or in life are those who can perform strict reps under pressure, year after year.
Resilience isn’t glamorous. It’s strict adherence to form and standards. Reps stacked and basics drilled.
Closing Thoughts
Thirty strict pull-ups for time really isn’t about the number. It’s about the mindset: constraints, no ego, and the discipline not to go again sooner than you can complete at least another set of 5, along with persistence under pressure.
The lessons extend beyond workouts. Whether you’re securing cloud environments, writing policies, or leading teams, following real constraints, practicing discipline, and building resilience are as vital as adhering to strict form in your pull-ups when required.
Constraints can make you sharper. Discipline makes you stronger. Resilience makes you unbreakable.
Persistence Beats Perfection
Chasing perfection can be tempting. It makes us believe that if we get everything exactly right, like following a flawless training plan or a perfect patch cycle, we’ll be safe from risks or mistakes. But perfection is fragile. One mistake or setback, and it falls apart. That’s when persistence matters most.
Persistence, on the other hand, is unbreakable and endures where perfection falters.
Anyone who’s trained in martial arts or strength sports knows some days you set PRs, some days you don’t. Some days you win; other days, you learn. The outcome of a single session doesn’t matter; what counts is that you keep showing up.
Cybersecurity runs on the same principle. Rather than expecting flawless results, it relies on the daily commitment, running scans, monitoring logs, and applying updates, which builds resilience over time.
Why Perfection Fails
- Unrealistic expectations: Nobody patches everything at once. Expecting to do so leads to burnout.
- Procrastination: Waiting until you can do it “perfectly” means it never gets done.
- Fragility: Perfection breaks under stress; persistence adapts.
Why Persistence Wins
- Consistency compounds. One small patch today, another tomorrow, adds up to systemic strength.
- Resilience under pressure. When incidents occur, teams that have developed daily habits respond more quickly.
- Adaptability. Persistence isn’t rigid; it bends, adjusts, and continues forward.
The Martial Arts Parallel
Martial artists don’t achieve mastery through perfection. They drill basics until instinctive, spar, fail, and adapt. Each session is about persistence; the discipline of returning to the mat, working on strikes, footwork, counter-wrestling, etc, etc.
Cybersecurity professionals must do the same. Drill, repeat, refine, and drill some more. That way, when the attacks come, your persistence in training wins the day.
Closing Thought:
Persistence, not perfection, is the key to success. Perfection is unattainable, persistence ensures progress, and tangible results.
Dispatches from the Blue Ridge
Slow enough to remind you that time still belongs to the mountains.
Song credit: Singing Song by Mipso
The Cloud’s Silent Killer: Misconfigured Defaults
In 2023, a single misstep by a Fortune 500 company left millions of customer records exposed simply by making a storage bucket public. This wasn’t an isolated incident. Misconfigurations like this are now the leading cause of devastating cloud data breaches, costing companies their reputation, customers’ trust, and millions in losses.
When you think of a data breach, you might envision elite hackers executing sophisticated attacks. However, the reality is far more alarming and preventable. Most breaches are the result of basic, avoidable misconfigurations, such as open buckets and overly broad permissions. These are mistakes anyone can make, and attackers are counting on it.
It’s tempting to trust default settings, they feel safe, like the standard path everyone takes. But most cloud defaults are built for quick setup, not lasting security. If you let them go unchecked, you’re leaving the door wide open for disaster.
The Usual Suspects
Let’s talk specifics. Over and over again, these defaults show up in post-mortem reports:
- Open storage buckets and blobs: Data storage left publicly accessible, sometimes with read and write permissions wide open. Attackers do not need to guess. They simply scan and find these vulnerabilities.
- Overly permissive IAM roles: The infamous *:* permission set (which allows access to all resources), granting far more access than necessary. It only takes one compromised credential to turn this into a complete takeover of the environment.
- Unrestricted security groups: Allowing traffic from “anywhere, any time” because it worked during testing… and then nobody locked it down.
These aren’t rare oversights. They’re everywhere, so common that attackers make a living scanning the internet for them. If you don’t fix them, it’s only a matter of time before someone else finds them first.
Why Defaults Are So Dangerous
- They lure you into a false sense of security, making you believe all is well until it’s far too late.
Teams assume that “default” means “safe enough.” But in reality, cloud vendors prioritize usability over airtight security. - They scale the wrong way.
What seems harmless in one instance becomes catastrophic when duplicated across dozens of accounts, regions, and services. - They’re hard to spot once deployed.
Without deliberate reviews, defaults blend into the noise. They look “normal,” even when they’re wide open.
Breaking the Cycle
So how do you stop defaults from turning into disasters?
- Audit your configurations against standards. Frameworks like CIS Benchmarks exist for a reason. They help ensure your usual settings are not leaving the door wide open.
- Enforce least privilege from the start. Treat it as your default stance. Add access only when necessary, and remove it just as quickly.
- Build guardrails into Infrastructure as Code. With tools like Terraform, CloudFormation, or ARM templates (methods for defining infrastructure settings in code), you can embed security policies that prevent dangerous defaults from being introduced unnoticed.
- Automate reviews and alerts. Cloud-native tools (such as AWS Config, Azure Policy, or GCP Security Command Center services) and third-party scanners can flag risky defaults before attackers do.
The Martial Arts Parallel
In martial arts, the stance you start with can determine the fight. A weak stance means you begin off balance before your opponent moves.
Cloud defaults work the same way. If you start with insecure settings, attackers already have the upper hand before you realize there’s a problem.
Closing Thoughts
The cloud makes it easy to move quickly, but speed without careful planning can be risky. Default settings may save you time, but they also make things much easier for attackers. Cloud security is not about dramatic battles or brilliant hackers. It is about consistently following basic best practices. Never assume that default means secure. Take responsibility and set your own standards.
Don’t wait for a wake-up call. Spend just 30 minutes this week: review one bucket, one IAM role, and one security group. Fix even a single misconfiguration. Share what you learn with your team. Every small action strengthens your cloud’s defenses and protects what matters most: your customers, your business, and your reputation.
Fueling Your Cybersecurity: How To Eat Right for Cyber Success
A Beginner’s Guide For Eating to Shed Fat, Revive Your Metabolism, and Sharpen Daily Performance.
Cybersecurity incidents don’t care how well you slept or ate. They happen anytime. If your body feels slow, your mind will too.
That’s why nutrition isn’t just about physique or gym numbers. It’s about resilience.
A strong body fuels a sharp mind, which makes you a stronger IT professional.
Before jumping in, you might ask: how do you build nutrition habits that fuel performance, even under pressure? Let’s break it down with these five rules:
Rule #1: Always Eat Protein First
If there’s one macro nutrient that changes everything, it’s protein. Most people under-eat it, even those who train.
- Why it matters: Protein saves muscle, keeps you full longer, and helps your body burn more calories.
- Aim for .75 to 1g per pound of lean or target body weight. Spread it across meals: eggs at breakfast, chicken or beef at lunch, fish at dinner, or a shake if needed.
Think of protein like a system update: without it, your body gradually weakens until you notice it, and by then it’s too late.
Rule #2: Drink this down deep into your SOUL – Carbs are NOT The Enemy
Carbs, like protein, provide 4 calories per gram.
Carbs get demonized needlessly. If you train hard, they’re your gas pedal—not optional.
- Performance: Carbs fuel high-intensity efforts (CrossFit, sprints, heavy lifts). They refill glycogen so your “engine” doesn’t sputter.
- Focus: Complex carbs—including all fruits, vegetables, and grains like rice—keep blood sugar steady. That means steady energy and fewer crashes.
The key isn’t cutting carbs. What matters is eating quality carbs at the right times.
- Hard training days? Eat more.
- Recovery days? Dial it back a bit.
Rule #3: Fats – The Slow-Burn Energy Source
Fats do not give quick energy like carbs, but they help you last longer. Fats are essential for hormone production, brain function, and recovery.
- Prioritize avocados, nuts, olive oil, walnut oil, and sesame oil, as well as grass-fed, wild-caught and free-range meats.
Most people do well with 20–30% of their calories from fat. That’s enough for health but not too much.
Rule #4: Hydration = Cognitive Uptime
Mild dehydration tanks focus faster than hunger. For IT pros, that’s dangerous.
- Target: ½ gallon per day minimum.
- Use electrolytes during long training or extended incident calls.
Think of hydration as uptime. Skip it, and your system crashes.
Rule #5: Structure Beats Willpower, Every Time
No one does well by guessing. Like securing a system, lasting results come from discipline and routine.
- Meal prep → Simple, repeatable meals built ahead of time.
- Macro targets: track for a few weeks until you get the feel.
- Boundaries: Sleep, fuel, and downtime are mandatory security controls.
The goal is not perfection; it’s persistence. Remember, chasing perfection can actually slow your progress. Aim for 80 to 90 percent consistency for the best results.
Closing Thoughts
Nutrition is about training, discipline, and resilience, and it all starts with each meal.
Forget fad diets, quick fixes, and guilt. Focus on what helps you daily: sufficient protein, good carbs, healthy fats, water, and sticking to a plan that eliminates guesswork.
Anyone with a strong body and sharp mind doesn’t just survive the grind; they thrive in it.
Soon, I’ll show you how to build simple, sustainable meal prep systems. You can protect your body and mind just like you protect your network: with structure and planning.
Remember: your body is your first line of defense. Fuel it like YOU matter.
Do You Even Eat Bro? Why Meal Prep Is Security for Your Health
Waaaayyy back in the day, when we launched our Paleo meal prep business, people used to love and also laughed at our meme tagline: “Do you even eat, bro?”
It was funny. But it was also the truth. Most people didn’t eat well, not because they didn’t care, but because they didn’t plan. And, the truth is, most people don’t invest any time in preparing their meals, and it costs them.
The business was built on a simple idea:
* Make eating clean easier than ordering pizza.
* Source only local, high-quality foods–from all of our fruits and veggies, to our choices of pasture-raised poultry and beef.
* Take the stress out of nutrition so people could focus on training, work, and life.
And here’s what I learned: meal prep is like security for your diet and prior proper planning always ensures success.
- Plan ahead, or get hacked by junk food. If you don’t have meals ready, DoorDash or the vending machine will win.
- Build guardrails, or chaos takes over. Structure (shopping lists, prepped meals, set eating windows) keeps you from drifting.
- Stay consistent, and resilience follows. Just like training or cybersecurity, it’s the boring reps that make you strong when it counts.
That’s why I still fall back on three rules that anyone can run with:
- Prep protein in bulk → Grill or roast a few pounds of chicken, beef, or fish. Protein is the foundation; everything else is garnish.
- Keep easy fruits & veggies on hand → Frozen, bagged, or pre-chopped. Don’t overcomplicate it. Rotate what you like.
- Don’t skip fats → Avocado, olive oil, nuts. They keep your hormones happy and your brain sharp when the day gets heavy.
It’s never about hitting 100% perfection. It’s about persistence — stacking small wins, meal after meal, day after day, week after week. Never forget the 80/20 rule to begin with, and do your best not to get overwhelmed. Small changes build habits that lead to permanent changes.
I didn’t always nail every meal, but because the vast majority of my meal were planned, I could keep training, keep coaching, keep working, and keep moving forward. One day at a time.
Never forget, meal prep is like security for your health and wellbeing. And, in the world I come from, when you fail to plan, you plan to fail.
And yes, I still eat, bro.
What’s your go-to meal prep hack that keeps you fueled during the week?
Matt Shannon, Security Pro 