Sign in Subscribe
Eckhart Mehler

Eckhart Mehler

Hamburg, Germany
Global CISO advising leadership teams on cybersecurity, governance, resilience, and emerging technology risks. Working across international environments where security, regulation, geopolitics, and digital transformation increasingly converge.
19
Jun
Can You Explain Why You Are Secure — Without Slides?

Can You Explain Why You Are Secure — Without Slides?

Cybersecurity leadership is tested when the slides disappear. This article explores why CISOs must explain security through clarity, judgment, assumptions, and ownership — not only through dashboards, heat maps, and polished board reports.
12 min read
19
Jun
Compliance Kills Curiosity: Rebuilding Security Culture After Certification

Compliance Kills Curiosity: Rebuilding Security Culture After Certification

16 min read
19
Jun
When Your ISMS Produces Documents — But Your Organization Produces Decisions

When Your ISMS Produces Documents — But Your Organization Produces Decisions

Your ISMS may be audit-ready — but is it decision-ready? A CISO perspective on why risk management fails when documented risks do not influence supplier approvals, go-lives, exceptions, and management trade-offs before decisions are made.
14 min read
17
Jun
AI in the SOC: Why We Didn’t Gain Control — We Scaled Complexity

AI in the SOC: Why We Didn’t Gain Control — We Scaled Complexity

AI promised control, speed, and automation in the SOC. Instead, many organizations scaled complexity. Why the future of security operations is not about more intelligence—but about governance, explainability, and decision quality.
6 min read
17
Jun
The Most Dangerous Sentence in Information Security? “That’s Not in Scope.”

The Most Dangerous Sentence in Information Security? “That’s Not in Scope.”

The most dangerous security gap is often not a vulnerability—it is an exclusion. Why ISMS scope is not documentation, but a governance decision that determines what an organization chooses to see, govern, and ultimately protect.
6 min read
16
Jun
Annex A Is Not a Security Strategy

Annex A Is Not a Security Strategy

Most organizations mistake Annex A for a security strategy. It isn’t. The greatest cybersecurity failures of the next decade may not come from missing controls, but from unchallenged assumptions about cloud, AI, resilience, and dependency.
6 min read
16
Jun
The Security Requirements Nobody Wants to Write

The Security Requirements Nobody Wants to Write

Security is no longer defined by the controls you implement, but by the dependencies you govern. The modern CISO’s role is not merely to protect systems—it is to ensure the organization remains in control when its assumptions fail.
5 min read
16
Jun
Privacy Is Complicated. Information Security Is Complex.

Privacy Is Complicated. Information Security Is Complex.

Privacy is complicated. Information security is complex. Boards, CISOs, CIOs and DPOs must understand the difference to build governance that creates real trust — not just documentation.
13 min read
16
Jun
Digital Trust Frameworks and the Quiet Erosion of Security Governance

Digital Trust Frameworks and the Quiet Erosion of Security Governance

Digital Trust Frameworks promise alignment across cybersecurity, privacy, AI and resilience. But what happens when governance quietly disappears into operations? A CISO perspective on why accountability—not architecture—is the true foundation of digital trust.
5 min read
16
Jun
Digital Markets Act (DMA) and AI: Impact on Platform Operators

Digital Markets Act (DMA) and AI: Impact on Platform Operators

The Digital Markets Act reshapes AI platform governance in Europe. This article explains how gatekeeper obligations, interoperability, data-sharing, self-preferencing rules and AI Act overlaps affect competition, compliance and innovation.
4 min read