During an incident, the most valuable intel is from people on the ground. Security teams rely on their colleagues across the organization to report issues quickly and without trying to fix things themselves.

I want to start with a confession that most security leaders will recognize but few will say out loud: almost everyone reuses passwords. Not the reckless or the untrained. Everyone including, if we are honest, a fair number of people in our own profession.

At any given moment, there’s an employee somewhere in the world tuning out of a phishing training module that was translated from another language. Every word is rendered correctly, yet the learner still stops paying attention.

In these situations, the translation often gets the blame for not engaging the learner, but the real culprit is design. When training isn’t made for international consumption in the first place, the module is set up for failure regardless of what happens when it reaches the translator.

Spies have always relied on technology, disguises, secret communications and clever gadgets, at least if the movies are to be believed.

But some of the most effective tools in the espionage business have always been people. Convince the right person to open a door, reveal a secret or trust someone they should not, and suddenly bypassing the sophisticated security system becomes unnecessary.

Securing the Tip of the Spear: Guam’s Path to Human and AI Resilience

As the Asia-Pacific and Japan (APJ) region continues its rapid digital acceleration, Guam stands at a unique strategic intersection. Serving as a critical hub for telecommunications, government services and regional defense, the island’s cybersecurity posture is no longer just a local concern, it is a cornerstone of regional stability.

“You’re gonna need a bigger boat.”

As a CISO advisor, I am observing a familiar pattern gaining a new, critical dimension. What we historically identified as "Shadow IT", the use of unapproved SaaS and tools, is rapidly evolving into "Shadow AI."

Employees are increasingly leveraging AI bots for drafting, analysis, code generation and strategic decision-making. While the intention is often to drive efficiency, the lack of governance creates a dangerous risk surface: sensitive data leakage, compliance violations and the potential for operational decisions based on unverified, AI-generated content.

Attackers are getting smarter. AI is making social engineering more convincing, more personalized, and harder to spot than ever before. Training the digital workforce, employees and agents, to recognize threats is necessary, but even the most security-conscious users can still make a mistake at the moment of risk.

I've spent my career figuring out what makes content stick, from early work for brands like Apple and onward across two decades across film, animation and generative AI. Different tools every few years, same question underneath. What makes someone lean in instead of tuning out?

In business, calling something a dinosaur is meant to suggest it is slow, outdated and overdue for extinction. Which is unfair to dinosaurs, who enjoyed one of the most successful runs in the history of life.