Practical security for real world businesses.

I started in the weapons department of U.S. Navy Trident submarines: the Lafayette class USS Casimir Pulaski (SSBN 633) and the USS Ohio (SSBN 726), maintaining Trident C-4 strategic weapons systems. On a boat, if a system fails, you do not open a ticket. You put the crew at risk. That is where I learned what security actually means: operational discipline, not theater.

Qualified in submarines: systems walkthroughs and board review

For the next two decades I took that habit into enterprise technology around Seattle: building, securing, and fixing infrastructure in the real world. I know the difference between what looks good on paper and what holds up when someone actually checks the environment.

I founded MorgSec for companies that need practical protection without a full time security staff. Between this practice and the rest of the portfolio, there are more kinds of work than one person can (or should) own. Associates take some of it. Referrals and partners take other parts. We put the right people on the job.

Private practice. I am the founder. This is not a government office and does not speak for the U.S. government. It is also not a pitch for me as the default assessor or solo consultant on every engagement. Client work is staffed through associates, referrals, and partners.

A gap analysis is not a questionnaire. It's a structured walkthrough of your environment against a control framework, and for most small to medium businesses, that means a structured control set appropriate to their risk and customer requirements. The process starts with asset inventory: a complete list of where sensitive business data lives, who touches it, how it moves between systems, and what the network boundary actually is. Most companies discover during this step that their sensitive data lives in more places than they thought, a shared OneDrive folder, a technician's personal laptop that connects to the shop Wifi, an unencrypted email archive going back three years.

Network mapping comes second. The goal is a current, accurate diagram of every device that can reach systems containing sensitive data, not just the servers, but every endpoint, printer, IoT device, and remote connection. Serious customers and auditors will often ask to see your network diagram. If it doesn't match the actual environment, that's a finding. If it matches but shows gaps (a switch with no logging, remote access without MFA, a contractor VPN with too much access), each of those is a separate control deficiency with a documented path to remediation.

Access control is where most organizations find their densest cluster of gaps. “Only authorized people get in” sounds simple, but enforcing it means reviewing every account that can reach sensitive systems, confirming departed employees are gone, verifying service accounts use minimum privilege, and checking that guests cannot wander into protected resources. In practice, most companies pick up three to five access gaps over a couple of years of normal change, turnover, new software, remote work. Finding them is mechanical. Fixing them before a customer or insurance review is the point.

This is the most important thing a small business needs to understand about compliance frameworks. Passing a checklist or certification means you documented controls that met a standard at a point in time. It does not mean your environment is secure against a motivated adversary. Those are not the same thing, and confusing them creates false confidence that leads companies to stop improving once they pass the assessment.

Compliance frameworks are necessarily backward looking. Many framework controls were written based on known threats and established best practices at the time of publication. The adversary community doesn't wait for the framework to be updated. Living off the land attacks that use legitimate system administration tools to move laterally after initial compromise don't require any malware to drop, they're invisible to most endpoint detection tools that look for malicious file signatures. A company that has checked every box on a framework and has no behavioral monitoring or network traffic analysis in place is compliant and vulnerable at the same time.

MorgSec cares about both outcomes because they answer different questions. A checklist or customer questionnaire may need documentation that proves you met a standard on a given day. Actual security is about whether your network is a soft target. The gap analysis maps what a customer or insurer may ask for. Ongoing advisory work covers what no static checklist fully captures: monitoring, incident readiness, and adjusting when the threat picture moves.