Brutalist CISO Notes
Jan 2026
A CISO's Minimal Notes Method
TL;DR
Capture fast, preserve decisions, and drive action, then reconnect the context later without upkeep. One note a day. Pen and paper or a plain text app.
The Method
A "second brain" sounds awesome with structured knowledge, everything tagged, and everything searchable. For a CISO, it usually collapses under its own weight.
Modern CISOs don't lack information. They face constant velocity, moving through executive meetings, incidents, budget politics, board pressure, regulatory noise, vendor churn, and internal power dynamics without pause.
A second brain assumes time to curate, file, maintain structure, and revisit it later, and a CISO rarely has that time. The more elaborate the system grows, the less it gets used, and it slowly turns into a digital attic where things go in and almost nothing comes back out. You end up managing the system instead of it serving you.
At this altitude, operational memory serves better than knowledge management. A CISO notes system only needs three jobs: capture fast, preserve decisions, and drive action. Everything else is overhead.
This method uses simple symbols to route information immediately, without folders, taxonomies, or future cleanup.
The symbols are:
* Context
+ Decision
-> Action
? Open decision (optional)
If a note doesn’t preserve judgment, record a decision, or move something in the real world, it isn’t useful.
Context is what future-you will forget or misremember.
Things like signals, constraints, executive intent, risk posture, or power dynamics. The political reality.
Examples:
* Finance blocking in a sneaky way headcount through “efficiency” language
* CEO framing next quarter around simplification, not growth
* Legal uneasy about owning breach comms again
This is what shapes decisions months later, when everyone swears the past was different.
Decisions are the highest-value artifact a CISO produces. They are also the first thing memory rewrites.
A decision line captures what was decided, why, and when it should be revisited if needed.
+ Remove CVSS from board reporting | false precision
+ Defer EDR migration | org instability + Q4 freeze | revisit Feb
+ Accept 60-day prod access review exception | revenue blocking
This creates defensible executive memory. Not just outcomes, but intent.
Open decisions live here too:
? Replace XDR this year or fund identity hardening
? Centralize IAM now or wait until post-M&A integration
Writing them down removes cognitive drag. They stop living only in your head and free valuable mental space.
Actions are one-line commitments. They are never buried, implied, or scattered.
Format:
-> verb + object — owner — timeframe
-> Confirm incident comms owner — Jim — by Thu
-> Rewrite board slide 5 to risk narrative — me — by Fri
-> Pull unmanaged AWS account list — Cloud Ops — by Mon
If something must move in the real world, it gets an arrow.
Capture is intentionally boring.
One note a day. Date at the top. Write continuously. Use the symbols.
Pen and paper works, whether it's a pocket notebook or index cards, as long as it opens instantly.
A notes app works too, one new note per day, plain text, no structure, built for fast open, fast write, and fast search. I'm partial to Auer Notes, which stays intentionally plain and optimized for fast capture and retrieval without imposing structure, though the tool itself is interchangeable. Even a single running .txt or .md file using Vi on the terminal works.
An app that pushes you to organize, tag, decorate, backlink, or curate works against you.
Search does the work. Search "->" for actions, "+" for decisions, and "*" for context.
Once a week, for five minutes, non-negotiable, search for "->" and ask three questions.
1. Is this done?
2. Is this dead?
3. Does this belong to someone else?
If it survives the week, you follow up or consciously kill it.
That’s the entire maintenance model.
This beats a second brain because there is nothing to maintain. No taxonomy, folders, or system to manage. The symbols route information instantly. The method survives incidents, board weeks, fatigue, and political churn.
Example Note
Friday 2026-01-16
* CEO pushing “simplification” narrative → budget pressure likely H2
* Legal uneasy about owning breach comms again
-> Confirm IR comms owner — Jim — by Thu
+ Do not centralize IAM this quarter | org churn + M&A fatigue | revisit Q2
Met with Cloud Engineering
* Shadow AWS accounts still appearing from acquired teams
-> Pull unmanaged account list + owners — Cloud Ops — by Mon
+ Allow temporary prod access exception | blocking revenue deploy | 60-day sunset
Board prep
* Directors respond to risk narrative, not control maturity
-> Rewrite slide 5 to material risk story — me — by Fri
+ Remove CVSS from board deck | false precision
Late afternoon
* CISO role informally expected to arbitrate product vs security disputes
-> Schedule standing biweekly with Product + Security — EA — next 2 weeks
? Solid-line product security or remain federated
No summaries. No transcripts. No knowledge gardening. Just what’s going on, what was decided, and what must move.
This is simply operational memory. And for a CISO, that's what's needed.
Note: this post also lives in CISO Notes.