“Now he’s completely lost it” is probably what a regular reader might think. After all, I use plain text (Markdown) as the “single source of truth”1 in my document workflow,2 and now I want proper charts for visualization. Not ASCII bars. Actual pie charts. The kind managers and decision-makers expect. That sounds like a fundamental contradiction. I would argue it is not. In fact, I solved it in a clean way. Read more

Over the past few days, I once again disappeared down the proverbial rabbit hole. But let’s start from the beginning. On Saturday, I wrote a blog post to outline an automated and deterministic document workflow.1 To make it easier to follow, I also set up a Codeberg repository.2 The feedback was unexpectedly overwhelming and raised many valid points. The repository itself had been put together quickly rather than thoroughly, so I ended up revising it significantly and renaming it in the process. It is no longer just a demo. It now represents a complete, highly flexible, and at the same time very simple document workflow. Read more

Over the weekend, I published a sample repository on Codeberg.1 It proposes treating ISMS documentation like code. The concrete example is an ISO 27001 risk assessment for organizational assets. The focus is less on the document itself and more on the underlying concept. Everything is written in a universal, text-only format that will still be editable in any editor 50 years from now: Markdown.2 Markdown comes with a few practical advantages: Read more

How many admins does it take to roll out 150 client PCs in one morning? The honest answer for most mid-sized companies: too many. If people are walking from machine to machine with USB sticks, the approach is fundamentally wrong and inefficient. What is missing are clear concepts, monitoring, automation, and scalability. In that order. Without automation, scaling turns into exploding personnel costs. Without monitoring, automation becomes a force multiplier for mistakes. Without clear concepts, monitoring ends up measuring the wrong things. Read more

“Ship fast, fail fast”, sometimes shortened to “fail cheap”, is a common mantra in agile environments.1 It addresses real problems with rigid processes, hierarchies, and tech stacks. For years, the industry has promised higher speed through agile methods. That sounds good. Still, when people ask if I work in an agile way, I avoid a straight answer. People confuse speed with maturity. Moving faster does not fix a wrong direction. Speed as replacement for clarity. Read more

For many, AI is the great promise for salvation. More efficiency, more ease, more future. Everyone is talking about it, so it must be true. And so many are jumping on the bandwagon, which, from the external perspective, appears to be a big party.My impression is that the discussion in medium-sized companies tends to focus more on opportunities and less on realities. There is a lack of honest assessment of the situation. And by that I don’t just mean the technology, but above all the non-technical governance. Read more

Not only since my seven security tips1 have I been getting questions about why I prefer to keep Windows and an Active Directory2 offline. That may sound inflexible, and in an era of AI-generated cybersecurity slop3 I may look like an outsider. So in today’s blog post I provide more context, explain the technical background, and lay out how ransomware works. Finally, I show how an AD operated offline can still be used with the internet and email as usual. Read more

A typical day in a mid-sized company. The already overworked developer, deep in crunch mode1 gets a quick note: “Would you please make the open invoices visible in the overview of all customers for this project?” Dutifully, he nods. He knows it’s an important project, the task isn’t technically difficult and the boss likes quick and simple solutions. So somehow “in between” late in the afternoon, he “enhances” the UI, “adds” extra queries to the frontend, “adjusts” the corresponding logic in the backend, and “builds” new views for tje resulting lists. He even goes the extra mile by making the invoices click- and viewable. Tired but satisfied, the developer leans back shortly before midnight with the good feeling of having improved the application. Read more

A typical crisis meeting scenario: The Management and myself as an external consultant or information security officer sitting in a conference room: Our processes are being slowed down by too many security requirements. Employees are complaining. ‘Your’ IT security is becoming a risk to our business. Such statements mark an important turning point for IT in small and medium-sized enterprises. They reflect concerns about change and loss of control. Where collaboration used to be shaped by proximity and hierarchy before, successful companies rely on teamwork, clear processes, modern management tools, and automation today. A few examples: Read more

It was the early 2000s and I was sitting there with a massive brick from Microsoft Press.1 The proud price back then: 129 Deutsche Mark. I flipped through it and felt a déjà vu: I knew these pages! Not in terms of content, but the layout, the structure, the examples, even the icons in the side notes: These were the lost manuals of the 1990s! Okay, for the younger generation, I’ll have to explain: Once software used to come in boxes. Big ones with printed books inside. At first, thick ring binders. Later, massive volumes printed on thin and razor-sharp bible-like paper. Overnight, these vanished. First to CD-ROMs, then into the still young internet. Read more