20 years ago, I learned first-hand how disconnected cybersecurity was from any organization smaller than an enterprise.

10 years ago, I took to the stage at BSides Columbus to pitch a different approach to building a cybersecurity program: The Common Sense Security Framework.

This year, I vetted the framework against data from the most well-known, well-established global cybersecurity reports, and you know what?

It fits like a glove.

The CSSF is built on two core beliefs: any program too complicated to explain to your C-suite is broken, and fundamentals will win the day.

Ten years changed both how we conduct business and the threat landscape, but it didn’t change my thesis. The average U.S. data breach costs continue to skyrocket (now $10.22 million), organizations still take too long to find and contain attackers (241 days), and generative AI has tipped the scales in the attackers’ favor with realistic phishing lures and deepfakes.

None of that happened because businesses lacked frameworks. It happened because complexity won and simplicity lost.

So what does the current data confirm we got right a decade ago? What really changed? What does common sense look like with AI, ten more years of board pressure, and a decade of breach reports added to the mix?

I built the CSSF version 2.0 to answer that. Same principles, sharper edges, and ten years of proof behind it.

Now it’s time to share the new CSSF with the world.