Pragmatic
Cybersecurity
REAL-WORLD SOLUTIONS FOR YOUR CYBERSECURITY PROGRAM
What Guides My Work
These six principles shape how I approach cybersecurity, not just in writing, but in every project, decision, and conversation.
PRACTICAL
Work that gets results, not just movement. Built on experience, supported by the right technology and frameworks.
CLEAR
No fluff, no jargon. Ideas explained in ways people can understand and apply, from the boardroom to the front line.
STRUCTURED
Methods that bring focus and consistency, supporting discipline and aligned action, not bureaucracy.
ADAPTABLE
Flexible in approach but steady in purpose, adapting as the environment demands.
HUMAN
Security is about people. Built on trust, communication, and real responsibility.
PROGRESS
Progress over perfection. Momentum matters more than flawless plans.
BOOKS
Cybersecurity, risk and leadership
Cyber Risk Management in Practice is available now. Adaptive Cybersecurity Leadership, with Rick Doten, is forthcoming on February 4, 2027.
INSIGHTS
Articles & conversations
Journal writing, interviews and new perspectives on cybersecurity in practice.
VIDEOS
Cybersecurity, in conversation
Explore my cybersecurity videos and book-related conversations.
THE AUTHOR
Carlos Morales
Cybersecurity executive, author, and educator with more than 20 years of experience connecting cybersecurity, technology risk, and business priorities.
Author of Cyber Risk Management in Practice and co-author of the forthcoming Adaptive Cybersecurity Leadership.
CONTACT
Continue the conversation
Connect with me on LinkedIn.
Subscribe
Get new articles on cybersecurity, risk and leadership by email.
You’ll receive an email to confirm your subscription. Unsubscribe at any time.
Latest articles
Cybersecurity at Scale: Why Risk, Coordination, and Leadership Stop Growing Linearly
Read article →: Cybersecurity at Scale: Why Risk, Coordination, and Leadership Stop Growing LinearlyThis paper explores how growth in systems, relationships and operational demand can change the way cybersecurity risk is managed. It offers a framework for discussion rather than a definitive scaling law. I’m sharing it as…
Behaviors That Make Cyber Risk Management Work
Read article →: Behaviors That Make Cyber Risk Management WorkCyber risk management in practice is more than tools and frameworks; it also depends on how we act. These 18 behaviors are part of what it takes to lead cyber risk with clarity, purpose, and…
AI Will Not Fix Bad Risk Management. It Will Scale It.
Read article →: AI Will Not Fix Bad Risk Management. It Will Scale It.AI can help risk teams work faster, but greater output does not automatically lead to better decisions. In this article, I examine how automation can amplify weak assessments, unsupported conclusions and processes that prioritize reporting…