Headline Features
Long-form examinations of significant cybersecurity developments, leadership decisions, and emerging risks.
Listen on Bare Metal Cyber →Bare Metal Cyber Magazine
Cybersecurity features with the space to explain what matters—and why.
Read original long-form analysis connecting emerging risks, security leadership, technology, governance, resilience, and practical professional judgment.
102long-form features in the podcast archive
Five Magazine Editions
Choose the kind of cybersecurity reading—or listening—that fits the week.
Cyber Talks
Practical discussions about cybersecurity work, leadership, careers, risk, and professional development.
Listen on Bare Metal Cyber →Friday Rollup
A written weekly view of notable developments, recurring themes, and the stories worth carrying into the next week.
Written editionCertified
Study guidance, difficult concepts, certification choices, and focused explanations for learners.
Listen on Mastering Cybersecurity →Insights
Focused educational pieces that clarify a concept, framework, technology, or professional challenge.
Listen on Mastering Cybersecurity →Headline Features
Current and upcoming editions.
Issue 36 · September 9, 2026
Data Gravity Wells: Where Sensitive Information Inevitably Sinks
The architecture diagram on the wall looks clean: a few core systems of record in neat boxes, arrows flowing between them, and a tidy ring of controls wrapped around the “crown jewels.” But when you trace how data actually moves in a modern environment, the picture changes.
Read the feature →
Issue 35 · September 2, 2026
The API Gold Rush: Security When Everything Becomes a Service
The room is quiet except for the click of keyboards and the hum of the projector. On the wall: a simple chart with one terrifying truth. Your API count has tripled in eighteen months; your headcount, process, and guardrails have not.
Read the feature →
Issue 34 · August 26, 2026
Controls Without Context: When Compliance Checklists Backfire
The dashboard says “green.” The annual assessment is done, the latest framework update is accounted for, and the audit committee has the slide they were asking for. But everyone in the room also knows that half the environment now runs on architectures that never existed when those controls were written.
Read the feature →
Issue 33 · August 19, 2026
Third-Party Truth Serum: Getting Real Answers from Vendors Who Say “Trust Us” — From Questionnaires to Continuous Validation and Shared Fate
The room is quiet except for the rustle of paper and the hum of a video call on mute. The business wants to sign a new critical SaaS platform, the vendor’s answers to your questionnaire are immaculate, and a glossy report from a well-known audit firm sits on the table.
Read the feature →
Issue 32 · August 12, 2026
Regulation Whiplash: Living Between DORA, NIS2, and SEC Disclosures
The meeting should have been routine. A major incident has just been contained, and the executive team is reviewing the draft communications plan. Legal wants to hold back until they can pin down “materiality” for the U.S. Securities and Exchange Commission (SEC).
Read the feature →
Issue 31 · August 5, 2026
Resilience over Perfection: Leading When “Secure” Is Never Done
The board chair looks across the table and asks a question you have heard a hundred times in different words: “So… are we secure?” The slide behind you is full of colors, control domains, and maturity scores, but you know none of it can honestly deliver the simple “yes” everyone wants.
Read the feature →
Issue 30 · July 29, 2026
Autonomous Agents, Unattended Risk: When Bots Start Opening Tickets for You
The moment doesn’t look dramatic. Someone proposes flipping a setting so that your AI agent can “helpfully” open tickets on its own instead of just suggesting them in a chat window. A few leaders nod, because tickets feel low stakes compared to pushing code or changing firewall rules.
Read the feature →
Issue 29 · July 22, 2026
Deepfake Governance: Policy, Evidence, and the New “I Didn’t Say That” Defense
The room is quiet except for the audio clip playing from a phone on the table. It sounds exactly like your chief revenue officer promising a partner something your lawyers would never allow. Heads turn toward them, and they do what more and more executives will do over the next few years: they shrug and say, “That’s a deepfake.
Read the feature →
Issue 28 · July 15, 2026
Red Team, Blue Models: Adversarial Testing in an AI-First World
The steering committee is five minutes from greenlighting a flagship AI feature. The slide on the screen shows a reassuring summary: “One-week AI red team, 27 jailbreaks found, all mitigated.” Screenshots of quirky prompt attacks get a few smiles.
Read the feature →
Issue 27 · July 8, 2026
Prompt Leaks and Side Channels: When “Internal Only” Isn’t
The vendor’s slide says it in comforting blue letters: “System prompts are internal only.” Around the table, heads nod. The co-pilot rollout moves forward, the risk register gets a neat line item, and everyone feels reasonably assured that the real business logic, the exception rules, the approval thresholds, and the ugly edge cases are…
Read the feature →
Issue 26 · July 1, 2026
LLM Roulette: When Every Employee Has a Different AI in Their Browser
By mid-morning, your organization is already running on at least half a dozen different brains. A sales lead is pasting redlined contracts into one browser-based assistant, an engineer is asking another model to sketch out a new API, and a marketing manager is quietly workshopping messaging in a consumer chat app on their personal laptop.
Read the feature →
Issue 25 · June 24, 2026
Bios, Chips, and Implants: Cybersecurity When the Endpoint Is a Human
The first time it comes up, it is usually not in a security steering committee. It is a plant engineer whose exoskeleton needs a firmware update, an executive with a cardiac implant asking about airport scanners, or a line manager wondering whether smart safety helmets are allowed on the factory floor Wi-Fi.
Read the feature →
Showing 12 of 52 features.