Writing
Searchable posts on AI governance, security, leadership, and platform engineering.
Field Notes is the working notebook of Michael York, VP of Information Security & DevOps at SavvyMoney — essays written from the day job, not by a content team. Coverage runs from security programs, SOC 2 and PCI compliance, and GRC in regulated fintech to AWS platform engineering, technology leadership, and risk. New essays land weekly; the topic hubs below collect them by theme.
Featured
Your Security Program Is a Sales Asset
Why provable security closes deals in regulated industries — and why the next budget conversation should lead with revenue, not fear.
AWS Cost Levers That Moved the Needle
Cutting ~35% off a multi-region AWS footprint with no capability loss — the levers in the order they paid back, best first.
More posts
The IT Strategy One-Pager the CEO Actually Quotes.
The sixty-slide IT strategy vanishes into a shared drive. The version that survives is short, opinionated, tradeoff-explicit, and quotable by the CEO.
A Roadmap Full of Projects Is a Backlog
A slide of thirty project names with quarters is a backlog, not a strategy. Anchor the roadmap to outcomes — and make every item name what it retires.
IT Operating Model: Org Chart to Value Chain
IT org charts name technology towers; the customer pays for every handoff between them. Redraw the function around business capabilities and value streams.
Cyber and AI Oversight From the Board Seat
Reporting to a board and sitting on one are different jobs. What reporting taught me about cyber and AI oversight, and what I'd ask from the director's seat.
The Renewal Clock Starts the Day You Sign.
Vendor leverage peaks before you deploy. Negotiate the renewal at signing — cap the uplift, kill the evergreen clause, and bring your own usage data.
Thinking Like a CIO, Not a Security VP
The jump to CIO is a change of altitude, not a bigger security job. The agenda I'd run — and the three security reflexes I'd have to consciously unlearn.
Security Culture Is a Control. Audit It.
Security culture is usually a poster — no objective, no defined behavior, no evidence, no failure mode. Give it those four and it audits like any firewall.
Fractional CIO: What 30–90 Days Actually Buy
A fractional CIO is not a discounted full-timer. What the first thirty, sixty, and ninety days each actually buy — and the honest limits of the seat.
Rank Your AI Pilots or It's Not a Portfolio
Forty unranked AI pilots is a science fair with a cloud bill. Run the portfolio like a VC book: expected value, feasibility, risk, and kill criteria up front.
Ransomware Recovery: A Tested-Backups Problem
Everyone has backups. Almost nobody has a restore they've actually run under fire. That gap is where ransomware turns a bad week into an existential one.
70 Security Tools, 9 Controls: Consolidate
The license fee is the cheapest part of a security tool — integration, console staffing, and alert fatigue are the real bill. Rationalize on control coverage.
Evidence as Code: Make the Next Audit Boring
Audits feel like fire drills because evidence is hunted after the fact. Machine-readable SOC reports and modern PCI rules let proof live in the pipeline.
Start Post-Quantum Migration in 2026
Post-quantum cryptography stopped being research and became a config task. The teams that win aren't waiting for a quantum computer — they wait for nothing.
Guardrails at Scale for a Three-Person Team
A lean team can govern a sprawling cloud estate without becoming a ticket queue — but only if you put the rules in the pipeline, not in your inbox.
Internal IT as a Product, or Shadow IT Wins
Internal platforms fail when run like monopolies. Give them product managers, roadmaps, honest adoption metrics — and let users defect to better tools.
Pre-Wire Breach Disclosure Before the Breach
Materiality, the SEC's four-day clock, the OFAC ransom gate: decisions to pre-wire with a standing disclosure committee, not improvise at hour three.
Context Lock-In Is the Next Vendor Risk
Everyone negotiated data egress and capacity in their AI contracts. Almost nobody negotiated the prompts, context, and memory that became the switching cost.
WAF in the Agent Era: Good Bots vs. Abuse
Agents are now real customers hitting your edge with real economics. The old bot question — human or machine? — is the wrong one. Here's the one that matters.
Tech Due Diligence: What Data Rooms Hide
A data room is built to close the deal. Technical debt, run cost, architecture risk, and key-person risk predict integration cost — and it hides all four.
Stop Charging the SSO Tax
SSO and audit logs are the controls a buyer needs to trust you — conversion features, not enterprise upsells. Paywall them and you tax your own funnel.
Consolidate SecOps on OCSF, Not Aggregators
Dashboard sprawl isn't a tooling gap you fix with more tooling — it's a schema problem. Standardize on OCSF and the single pane of glass becomes real.
Cluster Autoscaler to Karpenter: What Breaks
Karpenter is the right call for most EKS shops — but the migration breaks things unrelated to autoscaling. What to know before flipping the switch.
Autonomous Pentesting in a Regulated Shop
A tool that scans and exploits your estate on its own schedule is a gift and a loaded gun. The scoping, approvals, and evidence I'd want before it runs.
The Eight-Domain Azure Security Review
A tool scores your Azure posture; an assessor walks your architecture. The eight domains I review, in audit order, and the evidence each has to produce.
Vendor License Audits: Bring Your Own Numbers
A vendor "license review" is a revenue motion in compliance clothes. Reconcile entitlements against deployment continuously and walk in with your own number.
Zero-Downtime Database Changes Are a Process
Blue/green and serverless Aurora don't make migrations safe — the runbook does. The boring discipline that keeps schema changes from becoming incidents.
Cyber-Insurance Renewal Is a Second Audit
The underwriter's questionnaire is a prioritized controls roadmap; your renewal terms are a risk metric. Mine both and close the coverage-gap traps early.
Aurora DSQL for the Ledger: Active-Active
Multi-region active-active sounds like the answer to ledger nightmares. Interrogate the consistency, recovery math, and migration before betting the books.
Fine-Grained Authorization for Fintech APIs
Authorization scattered across your codebase isn't a feature — it's a liability you can't prove. The pattern multi-tenant regulated platforms actually need.
MCP Is a New Attack Surface: An IAM Playbook
Every MCP server is a new identity reaching into your cloud. Whether that's leverage or liability comes down to least-privilege IAM on every tool call.
Data Strategy Dies in the Funding Meeting
Data-strategy decks die in the funding meeting, not the architecture review — pitching a capability the CFO can't fund instead of a decision it changes.
Fraud and Security Are One Threat Model
Account takeover, synthetic identity, and scams sit between fraud and security — one adversary split across two budgets. Fuse the threat model and the signal.
The Integration Layer Nobody Owns
The org chart is a story; the point-to-point integration mesh nobody owns is your real operating model. Own it with an API platform and contracts.
Operational Resilience Is Not a DR Plan
A DR plan brings systems back; resilience keeps the service inside a limit the board owns — impact tolerances, service mapping, testing to failure.
Capex Died. Your Balance Sheet Didn't Notice.
SaaS and cloud moved tech spend to opex, quietly compressing EBITDA. That reopens the ASC 350-40 capitalization question — answered by engineering telemetry.
Insider Risk Without Becoming Surveillance
Insider risk is a governance program across HR, legal, privacy, and security — not a DLP purchase. Monitor the assets that carry the loss, not the people.
The Audit Passed in March. Is It Still True?
Point-in-time certification is the floor, not the goal. The case for continuous assurance over annual audits — and what it takes to run it year-round.
Core Modernization: Strangle, Don't Rewrite
A full rewrite is the most expensive way to modernize a core system, and the likeliest to fail. Sequence a strangler-fig migration — no blank check required.
How to Survive an FFIEC Exam
An exam isn't a pop quiz you cram for. It's referenceable proof of control — run it right and the examiner's findings become your best sales collateral.
The CISO Reporting Line Is a Risk Decision
Where the security leader sits decides whose incentives they inherit and how far bad news travels. The reporting line is a control the board should own.
PCI DSS 4.0 Without the Last-Minute Scramble
PCI DSS 4.0 didn't add a longer checklist — it changed who does the thinking. Bake continuous-control expectations into engineering, not audit-week cramming.
Technical Debt Is a Loan: Report the Interest
Engineers size technical-debt principal, never the interest. Measure the velocity tax where DORA metrics leave fingerprints; give every loan a verdict.
Run a Human-Risk Program, Not Awareness
Training completion is the cleanest number in the board deck and the least tied to risk. Score human risk per team and measure behavior, not attendance.
Report Risk to Those Who Don't Speak Security
Translating security for boards and investors — the three questions leadership actually asks, and how to answer them.
Data Privacy Is an Operations Problem
Every privacy promise rests on unglamorous plumbing — consumer-rights workflows, retention, DLP. Treat privacy as an operating program, not an annual PDF.
App Sprawl: 400 Apps and No Sunset Policy
You can't cut your way out of an estate that only grows. The fix: a TIME verdict on every app and a sunset policy making renewal a decision, not a reflex.
An SBOM Nobody Reads Is Compliance Cosplay
Generating a software bill of materials is the easy part. Wiring it into the moment a change ships is where supply-chain security stops being theater.
Warm Standby Is a Promise You Have to Test
A DR plan you have never exercised is a hypothesis with a logo on it. Warm standby only counts as a promise if you test the failover before you need it.
Put a Dollar Figure on the Risk Register
A heat map's red cell is a category, not a quantity. FAIR-style quantification puts a dollar range on each risk that the CFO can weigh against controls spend.
Threat Intel Your Sales Team Will Brag About
Most threat intel dies as a PDF nobody reads. Done right, it sharpens your defense and becomes something your account team wants to put in front of customers.
Security and DevOps Under One Roof
The case for running security and DevOps as one mandate: org-chart distance doesn't create security, and owning the pipelines changes how you protect them.
Treat Data Like a Product With an Owner
A data lake with no owner is deferred cost; every team that distrusts it rebuilds the same report. Domain ownership, contracts, and lineage fix that.
Tabletops That Find Real Gaps
Most incident tabletops are theater confirming the runbook. The useful ones break your assumptions and expose who decides — before a real incident does.
SOC Metrics Are Vanity Until Decisions Change
MTTD and MTTR look great on a slide and tell you almost nothing. The only metric that matters is whether it changed what someone did next.
Third-Party Risk When You ARE the Third Party
Serving 1,500+ financial institutions means vendor-risk teams audit you constantly. Done right, that scrutiny becomes the fastest way to close your next deal.
Underwrite the Security Budget Like a Loss
The security budget is the line defended with emotion — and emotion gets discounted. Price the loss, count the revenue it unlocks, argue in the CFO's math.
Capital Allocation Governance, Built Too Late
Mid-market capital allocation is rarely a strategy — capex, M&A, and debt decisions made in isolation. The governance framework that makes it programmatic.
Zero Trust for Humans: Just-in-Time Access
Everyone's obsessing over non-human identity. Meanwhile your humans sit on standing admin rights — and the fix only works if people will actually use it.
Stop Running IT as a Cost Center
IT shows up as one budget line, so the only move is "make it smaller." A P&L and price list — showback, unit economics — turn the argument to value.
Incident Response: The First 24 Hours
Most IR plans are binders nobody opens at 2 a.m. What has to happen in the first day of a breach — roles, decision rights, evidence, and a comms cadence.
The New Security Leader's First 90 Days
Hired to build a security function from nothing? The trap isn't moving too slow — it's freezing the business. How to triage, ship quick wins, and earn budget.
Board Reporting That Drives Decisions
The fifty-page board pre-read is the artifact most responsible for meetings that produce no decisions. Three sections fix it.
Post-Close Cyber Integration: A 100-Day Plan
The post-close decade is decided in the first 100 days. The eight cyber controls to ship by day 30, and the identity-sprawl audit every exit diligence will run.
Cloud FinOps: Where 25–40% of Spend Hides
The press-release version of cloud savings cancels workloads and books compliance debt. The durable version is commitment management and SaaS rationalization.