https://guptadeepak.com/ciso/ Free, ungated decision briefs, dated benchmarks, and browser-only tools for security leaders who have to make a call and then defend it to a board. en https://guptadeepak.com/ciso/benchmarks/shadow-ai-employee-usage/ https://guptadeepak.com/ciso/benchmarks/shadow-ai-employee-usage/ BlackFog and Sapio surveyed 2,000 UK and US employees: 49% use AI tools their employer has not approved. Governance starts from an inventory nobody has yet. Sat, 12 Sep 2026 12:00:00 GMT https://guptadeepak.com/ciso/benchmarks/vulnerability-exploitation-top-entry-point/ https://guptadeepak.com/ciso/benchmarks/vulnerability-exploitation-top-entry-point/ Verizon's 2026 DBIR put vulnerability exploitation at 31% of breach entry points, ahead of stolen credentials for the first time in 19 years of the report. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/benchmarks/third-party-breach-involvement/ https://guptadeepak.com/ciso/benchmarks/third-party-breach-involvement/ Verizon's 2026 DBIR puts third-party involvement in nearly half of all breaches, with supply chain breaches up 60%. The case for vendor review, and its limit. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/benchmarks/machine-identities-outnumber-humans/ https://guptadeepak.com/ciso/benchmarks/machine-identities-outnumber-humans/ CyberArk puts machine identities at roughly 82 per human. The sharper finding: 88% define privileged access as human-only, while 42% of machines hold it. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/benchmarks/security-market-vs-buyer-budget-growth/ https://guptadeepak.com/ciso/benchmarks/security-market-vs-buyer-budget-growth/ Gartner projects $240B in 2026 security spending, up 12.5%. IANS finds CISO budgets growing 4%. Both can be true only if spend is concentrating. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/benchmarks/security-share-of-it-budget/ https://guptadeepak.com/ciso/benchmarks/security-share-of-it-budget/ IANS and Artico Search surveyed 587 CISOs: security fell from 11.9% to 10.9% of IT budget, and budget growth slowed to 4%, the lowest in five years. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/benchmarks/b2b-buying-team-conflict/ https://guptadeepak.com/ciso/benchmarks/b2b-buying-team-conflict/ Gartner found unhealthy conflict inside three quarters of B2B buying teams. The deal is usually lost inside the committee, not to a competitor. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/benchmarks/b2b-buyers-prefer-rep-free/ https://guptadeepak.com/ciso/benchmarks/b2b-buyers-prefer-rep-free/ Gartner's 2026 survey found 67% of B2B buyers prefer to evaluate without a sales rep, up from 61%. The shortlist exists before first contact. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/benchmarks/security-buying-committee-size/ https://guptadeepak.com/ciso/benchmarks/security-buying-committee-size/ Gartner puts the modern B2B buying group at five to sixteen people spanning as many as four functions. Security purchases sit at the top of that range. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/benchmarks/security-tool-sprawl-25-tools/ https://guptadeepak.com/ciso/benchmarks/security-tool-sprawl-25-tools/ Wiz surveyed 300+ security leaders for its 2026 budget benchmark: 58% run more than 25 security tools, and nearly half say sprawl is holding the program back. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/when-saas-needs-head-of-security/ https://guptadeepak.com/ciso/when-saas-needs-head-of-security/ The usual advice ties this to headcount or revenue. Both are wrong. The trigger is the week security work stops being project-shaped and becomes a queue nobody can drain. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/what-triggers-a-security-budget-line/ https://guptadeepak.com/ciso/what-triggers-a-security-budget-line/ New security spend is almost never caused by a persuasive case. It is caused by an event with a date on it. Knowing which five events do it changes when you ask, not how. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/what-auditors-test-in-identity/ https://guptadeepak.com/ciso/what-auditors-test-in-identity/ Auditors do not evaluate your identity architecture. They pick names off a list and ask you to prove what happened. Elegant design earns nothing if the record is missing. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/tool-rationalization-playbook/ https://guptadeepak.com/ciso/tool-rationalization-playbook/ 58% of organizations run more than 25 security tools. This is the four-week program for finding the overlap, deciding what goes, and freeing budget without creating a hole. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/the-quiet-veto/ https://guptadeepak.com/ciso/the-quiet-veto/ The most consequential opinion in a security evaluation is usually formed in a private message by someone the vendor never met. Both sides of the deal should understand how that works. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/the-founder-ciso-problem/ https://guptadeepak.com/ciso/the-founder-ciso-problem/ A technical founder holding security has one real advantage nobody else has, and one disadvantage that compounds. Knowing which is which decides when to hand it over. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/the-cost-of-identity-debt/ https://guptadeepak.com/ciso/the-cost-of-identity-debt/ Identity debt never arrives as a security incident. It arrives as onboarding that takes nine days, an audit finding that recurs, and a migration estimated at one quarter that takes three. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/soc-2-as-a-sales-gate/ https://guptadeepak.com/ciso/soc-2-as-a-sales-gate/ For most B2B software companies SOC 2 is a sales requirement wearing compliance clothing. Reading it correctly changes three decisions: scope, timing against pipeline, and which exceptions you can live with. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/security-questionnaire-sales-weapon/ https://guptadeepak.com/ciso/security-questionnaire-sales-weapon/ Vendors treat questionnaires as overhead. Buyers treat them as diligence. Both readings are wrong: a questionnaire is the cheapest way one side of a deal shifts work onto the other. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/run-a-security-evaluation/ https://guptadeepak.com/ciso/run-a-security-evaluation/ Most security evaluations do not end in a bad purchase. They end in no purchase, six months later, with nobody able to say what happened. The failure is procedural, and it is fixable in the first two weeks. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/product-vs-corporate-security/ https://guptadeepak.com/ciso/product-vs-corporate-security/ A software company runs two security programs and funds them as one line. They have different customers, different failure modes, and different people, and merging them starves one of them. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/poc-scorecard/ https://guptadeepak.com/ciso/poc-scorecard/ Most POCs are scored on whether the product worked. That is the wrong question, because the vendor configured it. These fourteen criteria are the ones that predict month twelve. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/poc-or-reference-call/ https://guptadeepak.com/ciso/poc-or-reference-call/ A proof of concept costs weeks of engineering time you are not accounting for. Two good reference calls cost ninety minutes. The choice turns on one question: is the failure you care about visible from outside? Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/orphaned-agents/ https://guptadeepak.com/ciso/orphaned-agents/ An agent built by an engineer who left still holds credentials and still takes actions. Your offboarding checklist was designed for accounts a human logs into, and this is not one. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/non-human-identity-governance-first/ https://guptadeepak.com/ciso/non-human-identity-governance-first/ Buy a non-human identity tool first and you get a list of eleven thousand identities nobody owns. The ownership decision has to come before the discovery, and it is unglamorous policy work. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/killing-a-tool-murder-board/ https://guptadeepak.com/ciso/killing-a-tool-murder-board/ Security teams buy well and retire badly, which is how a stack reaches thirty tools. A murder board is the two-hour structure that makes a retirement decision defensible before it happens. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/iga-pam-or-itdr-first/ https://guptadeepak.com/ciso/iga-pam-or-itdr-first/ Three identity categories compete for the same budget line and vendors in each will tell you theirs comes first. The sequence is decided by which failure you can already evidence. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/identity-budget-in-plain-terms/ https://guptadeepak.com/ciso/identity-budget-in-plain-terms/ Identity is usually the biggest line in a security budget and the one a CFO understands least. Four cost centres, what each one actually buys, and how to defend the total. Fri, 28 Aug 2026 12:00:00 GMT https://guptadeepak.com/ciso/first-security-hire-is-not-an-engineer/ https://guptadeepak.com/ciso/first-security-hire-is-not-an-engineer/ Founders hire a strong application security engineer into the first security role and get an unhappy engineer doing spreadsheet work while the queue keeps growing. The job is program work. Fri, 28 Aug 2026 12:00:00 GMT