https://0xwolfe.com/blog/Recent content in Blog on 0xwolfeHugoen-ushttps://0xwolfe.com/blog/read-the-policy-before-you-sign-it/Fri, 02 Oct 2026 00:00:00 -0400https://0xwolfe.com/blog/read-the-policy-before-you-sign-it/<p>A company needs a security program, usually because a big customer sent over a questionnaire or sales promised a SOC 2 report by the end of the year. They bring in a virtual CISO, and a few weeks later a folder shows up with twenty or so polished policies: access control, change management, incident response, vendor management, encryption, acceptable use. Leadership looks them over in one meeting and approves them. A few months later the audit starts, and the auditor tests the company against those documents line by line.</p>https://0xwolfe.com/blog/hello-world/Wed, 30 Sep 2026 00:00:00 -0400https://0xwolfe.com/blog/hello-world/<p>Every security person eventually builds a personal site, and this is mine.</p> <p>I&rsquo;ll mostly write about building governance, risk, and compliance programs: what works, what falls apart in the first audit, and how to keep the program useful once the certificate is on the wall. I&rsquo;ll also write some about operations, because that&rsquo;s where most security programs live or die.</p> <p>Some posts will have nothing to do with work. Expect some astrophotography and Pokémon cards.</p>