[{"content":"","date":"3 July 2026","externalUrl":null,"permalink":"/tags/ai/","section":"Tags","summary":"","title":"AI","type":"tags"},{"content":"","date":"3 July 2026","externalUrl":null,"permalink":"/series/ai-in-grc/","section":"Series","summary":"","title":"AI in GRC","type":"series"},{"content":"With the rise of large language models, the intersection between AI and Governance, Risk, and Compliance (GRC) feels inevitable. One of AI\u0026rsquo;s greatest strengths is ingesting massive datasets and inferring the answers we need. In theory, this makes it perfect for risk assessments.\nIn this four-part series, I\u0026rsquo;m going to examine the real-world use cases for AI in GRC, weigh the benefits against the risks, and try to answer a tough question: Does AI actually belong in these workflows?\nMy History with the Hype # My skepticism isn\u0026rsquo;t coming from a theoretical place: Back when I was working on an enterprise security team a few years ago, we piloted an early-generation AI automation tool to handle our risk assessments. The pitch was seductive: feed it the questionnaires and docs, and let it spit out findings, severities, and remediation plans. The promise of cranking out risk reports at lightning speed was alluring.\nIn practice? It fell apart fast.\nHonestly, nine times out of ten, the output was useless for actual risk inference. Instead of speeding us up, the tool created a massive bottleneck. I found myself re-doing nearly the entire assessment, correcting hallucinations, and flagging critical gaps the AI completely missed. After a while, I stopped looking at its output entirely and went back to doing the work manually.\nThis wasn\u0026rsquo;t just a case of AI needing \u0026ldquo;human oversight.\u0026rdquo; It was a case of the tool being fundamentally incapable of handling the nuance. At that moment, it felt obsolete compared to human judgment.\nI always tell this anecdote to my friends in the industry when they panic about \u0026ldquo;AI is going to take our jobs!\u0026rdquo;. Here\u0026rsquo;s hoping they found it reassuring\u0026hellip;or at least amusing.\nBut That Was Then and This is Now: Has Anything Changed? # That experience made me deeply skeptical. But lately, as I\u0026rsquo;ve watched models evolve — seeing things like Claude and others find vulnerabilities in code that humans miss — I can\u0026rsquo;t help but wonder: Could they do the same for knowledge-based work now?\nCould today\u0026rsquo;s AI accurately discern risk from a policy document today? Can it evaluate a network diagram better than a junior analyst? Where does the line fall between leveraging AI and retaining expert judgment?\nI\u0026rsquo;m exploring these questions in this series. I won\u0026rsquo;t be running benchmarks or citing empirical data. Instead, I\u0026rsquo;ll be drawing on my years in the trenches to offer a pragmatic, maybe even messy, look at where we currently stand and where we may end up at the crossroads of AI and GRC.\nNext time, I\u0026rsquo;ll do something that doesn\u0026rsquo;t come naturally to me: argue in favor of AI in GRC. We\u0026rsquo;ll look at where it might actually earn its keep. Come back soon for that.\n","date":"3 July 2026","externalUrl":null,"permalink":"/insights/ai-in-grc-why-i-stopped-trusting-automation/","section":"Insights","summary":"An early AI risk-assessment pilot failed me badly. Years later, I’m reconsidering whether LLMs have earned a place in GRC workflows. Part one of four.","title":"AI in GRC: Why I Stopped Trusting Automation (And What I'm Reconsidering Now)","type":"insights"},{"content":"","date":"3 July 2026","externalUrl":null,"permalink":"/tags/grc/","section":"Tags","summary":"","title":"GRC","type":"tags"},{"content":"","date":"3 July 2026","externalUrl":null,"permalink":"/insights/","section":"Insights","summary":"","title":"Insights","type":"insights"},{"content":"","date":"3 July 2026","externalUrl":null,"permalink":"/tags/risk-assessment/","section":"Tags","summary":"","title":"Risk Assessment","type":"tags"},{"content":"","date":"3 July 2026","externalUrl":null,"permalink":"/series/","section":"Series","summary":"","title":"Series","type":"series"},{"content":"","date":"3 July 2026","externalUrl":null,"permalink":"/tags/","section":"Tags","summary":"","title":"Tags","type":"tags"},{"content":" Ready to Strengthen Your Security? # I am currently accepting new clients. Let\u0026rsquo;s discuss how Source Cyber Solutions can help protect your organization.\nSchedule a Strategy Session # Book a complimentary 30-minute call to discuss your challenges and see if we\u0026rsquo;re a good fit. No pressure, no commitment.\nBook a Strategy Session Send an Email # For general inquiries, RFPs, or if you prefer email:\n📧 inquiries@sourcecybersolutions.com\nWhat to Expect # Step Details Response Time Within 24–48 hours on business days Confidentiality All communications are handled with strict confidentiality No Obligation Strategy Sessions are free and carry no commitment Location # I work remotely with clients globally. For local engagements, I\u0026rsquo;m based in Cumming, GA.\nPrivacy \u0026amp; Data Requests # For data subject access requests, deletion requests, or questions about how your information is handled, contact:\n📧 privacy@sourcecybersolutions.com\nSee the Privacy Policy for full details on our data practices.\nConnect # LinkedIn: linkedin.com/company/source-cyber-solutions ","date":"29 April 2026","externalUrl":null,"permalink":"/contact/","section":"","summary":"Ready to Strengthen Your Security? # I am currently accepting new clients. Let’s discuss how Source Cyber Solutions can help protect your organization.\nSchedule a Strategy Session # Book a complimentary 30-minute call to discuss your challenges and see if we’re a good fit. No pressure, no commitment.\n","title":"Get in Touch","type":"page"},{"content":"Last Updated: May 14, 2026\n1. Introduction # This Privacy Policy explains how Source Cyber Solutions, LLC (\u0026ldquo;we,\u0026rdquo; \u0026ldquo;us,\u0026rdquo; or \u0026ldquo;our\u0026rdquo;) handles information when you visit our website at sourcecybersolutions.com.\n2. Information We Collect # Automatically Generated Data # Our web server (Nginx) generates standard access logs as part of normal operation. These logs may include:\nIP addresses. Browser type and version. Operating system. Timestamps of visits. Pages requested. Referrer data (the website you came from, if any). These logs are generated automatically by the server for operational and security purposes. We do not use analytics tools, advertising trackers, or any third-party data collection services.\nInformation You Provide # Email Inquiries: If you contact us via email, we retain your message and email address. Calendar Bookings: If you book a call via Proton Calendar, data is handled per Proton\u0026rsquo;s Privacy Policy. 3. Third-Party Services # We use the following third-party services to operate this website:\nService Purpose Privacy Policy DigitalOcean Website hosting DigitalOcean Privacy Proton Calendar Appointment scheduling Proton Privacy Proton Mail Email communication Proton Privacy 4. Cookies # This website does not use cookies of any kind — no tracking cookies, no analytics cookies, no advertising cookies. We do not employ Google Analytics, Facebook Pixel, or similar technologies.\n5. Data Retention # Server Logs: Retained for approximately 30 days for security monitoring, then rotated and deleted automatically by the server. Email Inquiries: Retained as long as necessary to address your inquiry. Calendar Data: Handled per Proton\u0026rsquo;s retention policies. 6. Your Rights # Depending on your location, you may have certain rights regarding your personal data, including:\nAccess: Request a copy of any data we hold about you. Deletion: Request deletion of your data. Correction: Request correction of inaccurate data. To exercise these rights, contact us at privacy@sourcecybersolutions.com.\n7. Security # We implement reasonable security measures to protect data, including:\nHTTPS encryption for all website traffic. Email encrypted in transit via TLS (note: end-to-end encryption applies only when both parties use Proton Mail or PGP). Minimal data collection by design. 8. Changes to This Policy # We may update this Privacy Policy from time to time. Changes will be posted on this page with a new \u0026ldquo;Last Updated\u0026rdquo; date.\n9. Contact Us # If you have questions about this Privacy Policy, please contact:\n📧 privacy@sourcecybersolutions.com\n","date":"29 April 2026","externalUrl":null,"permalink":"/privacy/","section":"","summary":"Last Updated: May 14, 2026\n1. Introduction # This Privacy Policy explains how Source Cyber Solutions, LLC (“we,” “us,” or “our”) handles information when you visit our website at sourcecybersolutions.com.\n2. Information We Collect # Automatically Generated Data # Our web server (Nginx) generates standard access logs as part of normal operation. These logs may include:\n","title":"Privacy Policy","type":"page"},{"content":" Tailored GRC Solutions for Healthcare, Energy, and Enterprise # I offer flexible engagement models designed to meet your organization\u0026rsquo;s specific needs. All services are delivered with a focus on actionable outcomes, not just theoretical compliance.\n1. Targeted Risk Assessment # Duration: 3 Weeks | Investment: Contact for Quote\nA focused assessment of your current security posture, identifying your biggest risks and providing a clear roadmap to address them.\nWhat You Get:\nDiscovery: Review of questionnaires and interviews with key staff. Gap Analysis: Evaluation against NIST CSF or CIS Controls. Risk Report: Formal document with Executive Summary, findings, and prioritized remediation steps. Presentation: 60-minute walkthrough of results. Best For: Organizations needing a baseline assessment or preparing for an audit.\n2. Compliance Readiness Program # Duration: 4–8 Weeks | Investment: Contact for Quote\nA comprehensive engagement to prepare your organization for specific regulatory frameworks (SOC 2, ISO 27001, HIPAA).\nWhat You Get:\nFramework Mapping: Aligning your controls with specific requirements. Policy Drafting: Creating or updating essential security policies. Evidence Collection: Guidance on gathering necessary audit artifacts. Mock Audit: A dry-run to identify last-minute gaps. Best For: Companies facing an upcoming audit or seeking certification.\n3. Supply Chain \u0026amp; Vendor Risk Management # Duration: Variable | Investment: Contact for Quote\nAssess and manage the risks introduced by third-party vendors, suppliers, and partners.\nWhat You Get:\nVendor Inventory: Mapping your critical third-party relationships. Risk Assessments: Evaluating vendor security postures against your standards. Contract Review: Ensuring security clauses and SLAs are in place. Continuous Monitoring: Strategies for ongoing vendor oversight. Best For: Organizations with complex supply chains or strict regulatory requirements regarding third-party data access.\n4. Security Policy Development # Duration: 2–4 Weeks | Investment: Contact for Quote\nCreation of a complete, professional security policy suite tailored to your business.\nWhat You Get:\nCore Policies: Acceptable Use, Access Control, Incident Response, Data Classification, etc. Procedures: Step-by-step guides for implementing policies. Review Cycle: A plan for maintaining and updating policies. Best For: Organizations with no existing policies or outdated documentation.\n5. Security Awareness Training # Duration: 2 Hours | Investment: Contact for Quote\nInteractive workshops designed to empower your team to be the first line of defense.\nWhat You Get:\nCustom Content: Training tailored to your industry risks. Phishing Simulation: Optional simulated attacks to test readiness. Post-Training Assessment: Measuring knowledge retention. Best For: Teams needing to meet compliance training requirements or build a lasting culture of security awareness.\nImplementation \u0026amp; Execution Services # While my primary focus is on strategy, assessment, and advisory, I also facilitate technical implementation and specialized execution as separate engagements. This includes:\nProject Management: Overseeing the deployment of security controls by your internal IT team or external vendors, ensuring alignment with our risk assessment findings. Control Implementation: Configuring security tools, firewalls, and access controls based on our remediation roadmap. Partnered Penetration Testing: Coordinating with trusted, specialized firms for active vulnerability testing. Interested in moving from strategy to execution? Let\u0026rsquo;s discuss your specific needs during a Strategy Session.\nNext Steps # Book a Strategy Session Schedule a Free Consultation Discuss Your Needs: We\u0026rsquo;ll identify the right engagement model. Receive a Proposal: Clear scope, timeline, and pricing. Get Started: Begin your journey to better security. ","date":"21 April 2026","externalUrl":null,"permalink":"/services/","section":"","summary":"Tailored GRC Solutions for Healthcare, Energy, and Enterprise # I offer flexible engagement models designed to meet your organization’s specific needs. All services are delivered with a focus on actionable outcomes, not just theoretical compliance.\n1. Targeted Risk Assessment # Duration: 3 Weeks | Investment: Contact for Quote\n","title":"Consulting Services","type":"page"},{"content":" Securing Critical Infrastructure \u0026amp; Complex Business Environments # Protecting your data, ensuring compliance, and building resilience.\nI am Alex Goodman, a CISSP-certified GRC specialist with 13+ years of experience helping organizations navigate complex security landscapes. From Fortune 100 enterprises to mid-market innovators, I bridge the gap between technical risk and business strategy.\nWhy Source Cyber Solutions? # In an era of evolving threats, a \u0026ldquo;checklist\u0026rdquo; approach to security isn\u0026rsquo;t enough. You need a partner who understands the unique pressures of your industry.\nDeep Industry Expertise: Specialized knowledge in HIPAA, NERC CIP, NIST, and critical infrastructure protection. Practical Solutions: Actionable roadmaps that balance security with business reality. Proven Track Record: 15+ years guiding teams from risk assessment to compliance readiness. Security \u0026amp; Privacy by Design: Built on the belief that security and privacy are fundamental requirements, not afterthoughts. How I Can Help # Service Ideal For Risk Assessments Organizations needing a clear view of their security posture. Compliance Readiness Teams preparing for HIPAA, SOC 2, ISO 27001, or NERC CIP audits. Policy Development Companies lacking documented security procedures. Security Awareness Training Teams needing to strengthen their human factor. Vendor Risk Management Organizations with complex supply chains or third-party oversight requirements. Ready to Strengthen Your Defense? # Let\u0026rsquo;s start with a conversation. I offer a complimentary 30-minute Security Strategy Session to discuss your challenges and see if we\u0026rsquo;re a good fit.\nBook a Strategy Session Or email me directly at inquiries@sourcecybersolutions.com\n","date":"21 April 2026","externalUrl":null,"permalink":"/","section":"","summary":"Securing Critical Infrastructure \u0026 Complex Business Environments # Protecting your data, ensuring compliance, and building resilience.\nI am Alex Goodman, a CISSP-certified GRC specialist with 13+ years of experience helping organizations navigate complex security landscapes. From Fortune 100 enterprises to mid-market innovators, I bridge the gap between technical risk and business strategy.\nWhy Source Cyber Solutions? # In an era of evolving threats, a “checklist” approach to security isn’t enough. You need a partner who understands the unique pressures of your industry.\n","title":"","type":"page"},{"content":" Principal Consultant | CISSP # With over 13 years of experience in Governance, Risk, and Compliance (GRC), I help organizations protect their most critical assets while meeting regulatory and business requirements. My approach is straightforward: cut through the jargon, focus on what matters, and deliver security programs that actually work.\nAreas of Depth # While I serve clients across industries, my deepest experience lies in:\nHealthcare: HIPAA, HITECH, patient data privacy, and electronic health record security. Energy \u0026amp; Utilities: NERC CIP and critical infrastructure protection. These are high-stakes environments where security failures have real-world consequences. That perspective shapes how I approach every engagement, regardless of industry.\nCredentials # CISSP (Certified Information Systems Security Professional) 13+ Years in GRC across healthcare, energy, and enterprise environments Team Lead experience managing cross-functional security initiatives Specializations: Risk Assessment, Compliance Readiness, Policy Development, Incident Response Planning, Vendor Risk Management, Supply Chain Risk Management My Philosophy # I believe security is a continuous process, not a checkbox. Transparency, pragmatism, and collaboration are the foundation of every engagement. If you want the full story behind how I approach this work, check out my Ethos page.\nGiving Back # I actively mentor newcomers to the cybersecurity field because the next generation of defenders needs guides, not gatekeepers.\nOutside of Work # When I\u0026rsquo;m not analyzing risk matrices, you\u0026rsquo;ll find me spending quality family time with my wife and son, competing in security CTF competitions, tinkering with open-source tools and privacy-preserving technologies, or playing Magic: The Gathering.\nLet\u0026rsquo;s Connect # I\u0026rsquo;m always happy to discuss cybersecurity challenges or how we can strengthen your organization\u0026rsquo;s defenses.\nBook a Strategy Session Or email me directly at inquiries@sourcecybersolutions.com\n","date":"21 April 2026","externalUrl":null,"permalink":"/about/","section":"","summary":"Principal Consultant | CISSP # With over 13 years of experience in Governance, Risk, and Compliance (GRC), I help organizations protect their most critical assets while meeting regulatory and business requirements. My approach is straightforward: cut through the jargon, focus on what matters, and deliver security programs that actually work.\nAreas of Depth # While I serve clients across industries, my deepest experience lies in:\n","title":"About Alex Goodman","type":"page"},{"content":" Principles That Guide My Work # At Source Cyber Solutions, I believe that cybersecurity is not just a technical discipline; it is an ethical imperative. Every risk assessment, every policy, and every recommendation carries real-world implementation implications and consequences for real people.\nHere are the principles that define how I work.\n1. Human Judgment Over AI Automation # Artificial Intelligence is a powerful tool, but it lacks the intuition, context, and lived experience required to navigate complex, unique business environments. AI cannot detect the subtle nuances of a flawed control implementation or the hidden risks in a specific organizational culture.\nMy Promise:\nEvery assessment is reviewed by a human expert with a vast career of field experience and deep knowledge of the security landscape and industry regulations. I never feed your sensitive data into public AI models for training. I leverage AI for efficiency where appropriate, but never for judgment. In Governance, Risk, and Compliance, the human element is paramount.\n2. Radical Transparency # Trust is built on honesty. I strive to be as transparent as reasonably possible about my methods, my data practices, and my limitations.\nNo Hidden Agendas: If a finding is low-risk, I say so. If you don\u0026rsquo;t need a service, I tell you. Tailored Communication: I speak the language of your audience; whether it\u0026rsquo;s technical depth for engineers or strategic risk for the C-suite. Transparent Methods: My privacy policy is public and plain-spoken. I don\u0026rsquo;t use tracking cookies, analytics, or third-party data brokers. Read my Privacy Policy →\n3. Made in America # All work is performed onshore, in the United States, leveraging American ingenuity and unwavering integrity.\nI do not offshore my analysis or outsource my judgment. In the nuanced world of risk management, understanding cultural context, regulatory language, and business dynamics is key. Language barriers and time-zone delays can obscure critical details.\nWhen you work with me, you are working with a partner who understands the American business landscape, the regulatory environment, and the stakes involved in protecting your reputation and your people. I am also equipped to navigate the complexities of multinational and international engagements when required.\n4. Partnership, Not Transactions # You are not a ticket number or a revenue metric. You are a partner.\nI care deeply about security because I know what is at stake. I invest in long-term relationships, not one-off engagements. I treat your challenges as if they are my own. Your security is my priority.\n5. Security \u0026amp; Privacy by Design # I don\u0026rsquo;t just tell clients to \u0026ldquo;walk the walk\u0026rdquo;: I do it myself. Every aspect of Source Cyber Solutions is engineered to reflect my values:\nMinimal Third-Party Services: I limit my digital footprint to reduce attack surface. I carefully vet every vendor I use, doing my due diligence to prioritize those with transparent privacy policies and a track record of responsible security practices and respecting user data. Data Stewardship: I recognize that while your organization remains the Data Owner, I act as your Data Custodian during the engagement. I collect only the data strictly necessary to perform my work, treat it with the highest standard of care while it is in my possession, and respect your ultimate authority over how it is used, retained, or disposed of. Audited \u0026amp; Open Source Tools: I prefer tools I can inspect and trust over \u0026ldquo;black box\u0026rdquo; proprietary software. Local-First Workflow: I prioritize solutions that maximize control over your data, minimizing reliance on opaque third-party ecosystems. End-to-End \u0026amp; Zero-Knowledge Encryption: Wherever possible, I use tools that ensure only you and your intended recipients can access your data. I choose solutions and vendors based on their cryptographic guarantees, not just their server locations or marketing promises. 6. Education Over Gatekeeping # Cybersecurity is complicated, but it shouldn\u0026rsquo;t be a secret club. I believe knowledge should be shared, not hoarded.\nMentorship: I actively mentor newcomers to the field. Community: I share insights, tips, and best practices freely. Empowerment: My goal is to leave you more knowledgeable than when we started. Security is everyone\u0026rsquo;s responsibility. I am here to help you understand yours.\n7. Protecting People, Not Just Data # A data breach is a financial and reputational disaster for a business. But for the individuals whose data is exposed, the impact can be devastating: identity theft, fraud, and loss of privacy.\nI am driven by the mission to not only protect businesses but to protect people and empower businesses to do the same.\nMy Core Values # Pragmatic: I solve real problems, not theoretical ones. Ethical: Bound by professional codes and personal integrity. Relentless: Always learning, always adapting. No Shortcuts: Quality and thoroughness are non-negotiable. \u0026ldquo;Security is a process, not a product.\u0026rdquo; — Bruce Schneier\n","date":"21 April 2026","externalUrl":null,"permalink":"/ethos/","section":"","summary":"Principles That Guide My Work # At Source Cyber Solutions, I believe that cybersecurity is not just a technical discipline; it is an ethical imperative. Every risk assessment, every policy, and every recommendation carries real-world implementation implications and consequences for real people.\nHere are the principles that define how I work.\n1. Human Judgment Over AI Automation # Artificial Intelligence is a powerful tool, but it lacks the intuition, context, and lived experience required to navigate complex, unique business environments. AI cannot detect the subtle nuances of a flawed control implementation or the hidden risks in a specific organizational culture.\n","title":"Ethos","type":"page"},{"content":"","externalUrl":null,"permalink":"/authors/","section":"Authors","summary":"","title":"Authors","type":"authors"},{"content":"","externalUrl":null,"permalink":"/categories/","section":"Categories","summary":"","title":"Categories","type":"categories"}]