A practitioner's site. Notes, small tools, and arguments on GRC, security, data security, and the AI questions worth taking seriously.https://peter.triergarbers.com/https://peter.triergarbers.com/writing/dbir-2026-three-findings/https://peter.triergarbers.com/writing/dbir-2026-three-findings/Vulnerabilities overtake credentials as the top initial access vector, third-party involvement doubles again, and AI's first impact is industrialization — not innovation.Wed, 20 May 2026 00:00:00 GMTsecuritygrcaithird-party-riskhttps://peter.triergarbers.com/writing/from-heat-maps-to-decisions/https://peter.triergarbers.com/writing/from-heat-maps-to-decisions/Heatmaps destroy the information your security stack is already generating. The fix is Decision Quality, three data sources, and a curve instead of a colour. Companion to my V2 Security 2026 talk.Mon, 11 May 2026 00:00:00 GMTgrcrisk-quantificationstrategyv2-securityhttps://peter.triergarbers.com/writing/the-timeline-is-collapsing-faster-than-defenses-can-adapt/https://peter.triergarbers.com/writing/the-timeline-is-collapsing-faster-than-defenses-can-adapt/Median time-to-exploit dropped from 771 days in 2018 to under 1 day in 2026 — AI removed the compute bottleneck. Five moves defenders should make now.Wed, 29 Apr 2026 00:00:00 GMTaisecuritygrc