There is a cyber conversation co-founders of growth-stage companies almost never have with one another. A Sunday letter on why that absence is no longer defensible in 2026.

The SBOM is not the deliverable. The query you can run against it at 3 a.m. during the next critical disclosure is the deliverable. Field notes from the iSECTECH desk in 2026.

The incident report is the single most truthful document a security program ever produces about itself. A Sunday letter on why boards must read at least one a year.