SEC rules now require board-level cybersecurity disclosure. Here's what to actually track.
Since 2024, public companies must disclose material cybersecurity incidents within 4 business days and describe board oversight of cyber risk annually.
Board dashboard should include: security posture score (aggregate risk), open critical vulnerabilities (count + age), incident history (last 12 months), security investment as % of IT budget (benchmark: 10-15%), insurance coverage vs. estimated breach cost, and compliance status (SOC 2, ISO 27001, etc.).
Like this analysis?
Get the weekly engineering economics briefing - one email, every Monday.
Subscribe Free →Most boards delegate technology oversight entirely to the CTO. That's a governance failure.
9 minCompanies with technology committees make better acquisition, architecture, and investment decisions.
8 minAI creates new liability categories that traditional governance frameworks don't cover.
11 minThe compounding gross margin penalty incurred when variable LLM inference query costs scale faster than subscription revenue, shifting server hosting into variable Cost of Goods Sold (COGS).
Read Concept →A binary execution control mechanism that halts autonomous AI agent operations within 5ms when safety rules or environmental hash boundaries are breached.
Read Concept →The architectural pattern enforcing hard-coded, code-level execution gates and state verification outside the probabilistic LLM inference loop.
Read Concept →The systemic financial risk created when high-velocity AI code generation produces massive volumes of un-audited, low-trust technical debt that inflates future maintenance liabilities.
Read Concept →The engineering debt accumulated when developers accept AI-generated code based on superficial execution ("vibes") without understanding underlying architectural assumptions or edge cases.
Read Concept →The enterprise control framework governing security, compliance, operational boundaries, and audit trails for autonomous AI models and multi-agent workflows.
Read Concept →Unmonitored artificial intelligence tools and autonomous agents deployed by employees without explicit IT or security oversight.
Read Concept →The uncontrolled accumulation and uncoordinated deployment of autonomous AI agents across an enterprise environment.
Read Concept →A vulnerability where adversarial user inputs are crafted to override the original instructions of a large language model.
Read Concept →A degenerative process where AI models experience severe performance degradation after being iteratively trained on synthetic data generated by other models.
Read Concept →The financial discipline of managing, projecting, and optimizing the per query token costs associated with running large language models in production.
Read Concept →The critical threshold where the operational cost of maintaining a codebase and resolving technical debt exceeds the engineering capacity available for new feature development.
Read Concept →The non-linear increase in communication overhead, alignment meetings, and process friction that occurs when scaling engineering organizations, ultimately degrading per-capita execution capacity.
Read Concept →The systemic masking of growing software maintenance liabilities (OpEx) behind inflated velocity metrics and new feature launches, creating a fragile engineering economy that requires constant new capital to sustain.
Read Concept →The systemic erosion of traditional SaaS gross margins caused by the integration of generative AI features, as variable compute and API costs scale linearly or exponentially with user engagement, fundamentally altering software unit economics.
Read Concept →The principle that heavily AI-augmented teams of ten elite engineers can now achieve execution parity with traditional enterprise engineering organizations of over one hundred, fundamentally altering the economics of software creation.
Read Concept →The architectural pattern of storing and reusing similar LLM query results using vector embeddings to bypass redundant frontier model API execution and eliminate variable COGS.
Read Concept →Zombie Code refers to deprecated or unused features that continue to run in production, consuming maintenance budget, compute resources, and engineering focus. The Sunset Protocol is the structured mechanism for financial remediation through systematic deletion.
Read Concept →The strategic shift of migrating high-volume inference tasks from commercial Frontier APIs (OpenAI, Anthropic) to local Small Language Models (SLMs) to achieve financial breakeven on variable COGS.
Read Concept →The analytical process of converting standard engineering performance metrics (Deployment Frequency, Lead Time, MTTR, Change Failure Rate) into direct financial liabilities and capitalization impacts on the P&L statement.
Read Concept →The Innovation Tax is the hidden cost of maintenance work that gets reported as innovation investment. It is OpEx masquerading as R&D investment, causing organizations to dramatically overestimate their effective engineering velocity and R&D productivity. Here's how it works: A VP of Engineering reports to the CEO that "65% of engineering time is spent on new features." The actual breakdown, when forensically audited, reveals that only 23% of engineering time produces genuine new capabilities. The remaining 42% is maintenance work embedded within feature sprints - bug fixes bundled into feature stories, infrastructure upgrades coded as dependencies, and refactoring disguised as feature prerequisites. This 42-point gap between reported and actual innovation investment is the Innovation Tax. It's not fraud - it's systematic self-deception enabled by the way agile teams organize work. When a sprint contains 10 stories and 4 of them are technical debt cleanup dressed as "tech stories" within a feature epic, the team genuinely believes they're spending 100% on features. The Innovation Tax is insidious because it compounds. As the maintenance burden grows quarter-over-quarter, the tax increases. But because teams don't measure it, CFOs and boards continue to believe R&D spending is generating proportional innovation output. By the time the gap becomes visible (missed deadlines, slow feature delivery, competitive lag), the organization is often approaching the Technical Insolvency Date. Benchmarks from Richard Ewing's audits show that most engineering organizations have an Innovation Tax between 30-50%. Organizations with Innovation Tax above 40% are in dangerous territory. Above 70% is terminal - the organization is approaching technical insolvency within 4-6 quarters.
Read Definition →The Kill Switch Protocol is a structured framework for identifying and deprecating "Zombie Features" - code that requires ongoing maintenance but generates zero incremental business value. Most software organizations have a dangerous bias: they add features but never remove them. Product teams celebrate launches. Nobody celebrates deletions. Over time, this creates what Richard Ewing calls "feature gravity" - a constantly growing codebase where 40-60% of the code serves no active users and generates no measurable revenue, yet still consumes engineering maintenance hours. Zombie features come in several varieties: - **Ghost Features**: features that were built, launched, and never adopted. They sit in the codebase, requiring maintenance, but have near-zero usage. - **Legacy Bridges**: compatibility layers, deprecated API versions, and backward-compatible code paths that serve a tiny percentage of users but add complexity to every future change. - **Vanity Features**: features built because a senior stakeholder wanted them, not because users needed them. Often protected by organizational politics rather than business merit. - **Abandoned Experiments**: A/B test variants that were never cleaned up, prototypes that became permanent, and "temporary" solutions that became load-bearing. The Kill Switch Protocol provides a systematic approach to identification, evaluation, and deprecation: 1. **Identify**: Flag features with less than 5% of peak usage, zero revenue attribution, or maintenance cost exceeding 10% of the feature's value contribution. 2. **Quantify**: Calculate the total cost of keeping each zombie alive (maintenance hours × fully-loaded engineer cost × opportunity cost multiplier). 3. **Assess Risk**: Evaluate deprecation risk - what breaks if this feature is removed? What customers are affected? 4. **Sunset Timeline**: Create a communication plan and graduated deprecation (warning → deprecation notice → feature flag → removal). 5. **Execute**: Remove the code with rollback capability. Monitor for unexpected breakage. The typical Kill Switch audit reveals that 30-50% of maintenance burden comes from zombie features. Removing them frees up 15-25% of engineering capacity for actual innovation.
Read Definition →The AI Economist - Quantifying engineering economics for technology leaders, PE firms, and boards.
Run a free diagnostic first. If the numbers concern you, book a session to build a remediation plan.
Richard Ewing - AI Economist & Capital Auditor