The manifesto

Act when the evidence is incomplete.

An incident rarely announces itself with certainty.

A detection may be weak. A system may behave strangely. A user may report something that cannot yet be reproduced. Waiting for proof can give an attacker time.

Threat hunting exists because detection is incomplete. Incident response exists because waiting for perfect information is not an option.

Courage in security means investigating the uncomfortable possibility, escalating when the evidence warrants it and taking action before every question has been answered.

Protect the people who must use the control.

Security controls change how people work.

A control that creates constant friction will produce workarounds. Users will share credentials, bypass processes, create unmanaged solutions or ask for exceptions.

That behaviour is predictable. Design for it.

MFA, privileged access, endpoint restrictions, DLP and access controls must account for the legitimate work users need to perform.

The objective is to make the secure path usable enough that people can follow it.

Respect every boundary you are given access to.

Privilege gives you capability. It does not give you permission to use that capability everywhere.

Least privilege limits access to what a role requires. Segmentation limits where systems can communicate. Data classification limits who should handle information. Separation of duties limits what one person can control.

The same principle applies to vulnerability disclosure. Finding a weakness does not make exploitation or public disclosure automatically appropriate.

Security depends on boundaries being meaningful.

Make the system tell the truth.

Security decisions depend on the accuracy of the information behind them.

An inventory must represent the assets that actually exist. Logs must represent what actually happened. Configuration records must represent the deployed state. Integrity controls must detect unauthorised changes.

A dashboard showing 100% compliance is useless if the underlying inventory is incomplete.

A security control cannot compensate for false information upstream.

Hold your standard when nobody is watching.

Compliance creates an external requirement. Security governance creates an internal responsibility.

Audits, certifications and regulatory obligations matter. They also create a temptation to optimise for evidence rather than behaviour.

The stronger test is what happens between audits.

Do you patch because the vulnerability is real? Do you review privileged access because the access creates risk? Do you investigate control failures when nobody has asked for the report?

Internal assurance exists to answer these questions.

Protect what has been entrusted to you.

Every security role carries a form of stewardship.

An administrator receives privileged access. An engineer receives production access. A developer receives access to source code. An employee receives access to company information.

That access exists because someone trusts the role.

Security culture becomes effective when people understand that responsibility comes with access. Reporting a suspicious email, challenging an unsafe change or protecting a credential becomes part of doing the job correctly.

Technology can restrict behaviour. It cannot create responsibility.

Control your actions before you control the system.

Most operational mistakes do not require malicious intent.

Someone changes a firewall rule under pressure. An administrator disables a control to solve an outage. An engineer modifies production without review. A temporary exception becomes permanent.

Change management, peer review, emergency procedures, rollback plans and privileged workflows exist because people make decisions under pressure.

Self-control is the behaviour. The process is how the organisation makes that behaviour repeatable.