About · Why UpIsland exists
The role was designed for a threat surface that no longer exists. The work didn't shrink — the staffing did. UpIsland is an attempt to fix that by changing the shape of the office, not by asking humans to run faster. Built in public, by a working CISO, on top of an open AI substrate.
structural, not personal
Attackers are accelerating across speed, sophistication, and scale. Tooling on the offensive side compounds; defensive practice still asks one person to read three dashboards and reconcile them by hand.
For most organisations — especially SMEs — the CISO role is structurally broken. It was built for a budget and a headcount that doesn't exist, and we've spent a decade documenting our activity while the business has felt no safer.
The honest read: the gap isn't a willpower problem and it isn't a vendor problem. It's a shape problem. Same role, same eight hours, against a threat that runs around the clock at machine speed.
02 / the wager
Three properties an office has to have to compete with what's on the other side. Less a slogan than a checklist — each letter is a real design constraint that throws away most of the implementations available to us.
Decisions, evidence, response — at machine speed when machines should be running them. Humans where judgement is non-delegable. Nowhere else.
Context-aware, architecturally grounded, opinionated. Agents that know which assumption they're standing on and which one they're testing. Not slop, not vibes — defended conclusions.
Every output traces to evidence the agent can show its work on. No reports without receipts. No claims without probes. The audit trail is the product.
a virtual office, not a chatbot
The office isn't one general assistant. It's a team: an analyst that enriches signal, a control owner that runs SOPs end-to-end, a vendor reviewer, an IR triage, a board translator. Each one is purpose-built for a job the role was never staffed to do at speed.
Each agent is context-aware — it reads the artifacts it needs before it acts. Architecturally grounded — it knows where its authority ends. Autonomous where it has earned the right to be, supervised where it hasn't. The lifecycle of the role, at every layer, with humans in the loop exactly where humans add value and absent everywhere else.
Underneath: standard operating procedures, finally written down with the precision that the speed demands. SOPs were always supposed to be the unit of trust. They never were, because nobody had the time. The agents have the time.
04 / in public
The field's failure-to-communicate problem is real. Hiding the work is part of how we got here. If the next shape of the office is going to be any better, the work has to be inspectable. So we build it where it can be read.
standing on shoulders
UpIsland sits on top of PAI — the Personal AI Infrastructure pattern Daniel Miessler put into the world. PAI proves that a personal AI stack can be assembled from open parts, owned by its operator, and tuned to a real life rather than a generic product.
We adapt that pattern for a different operator: not an individual, but the CISO office. Same principles — open, composable, owned, evidence-driven. Different domain — security work, with the failure modes and adversarial pressure that come with it.
Nothing here is invented from scratch. It's the better-known parts of the field, finally wired together, with a CISO holding the pen.
Subscribe — free, forever
One email a week from inside the CISO office stack — what shipped, what broke, what the agents got wrong, what's worth your Monday morning. About ten minutes. Unsubscribe in one click.
free · unsubscribe anytime · gdpr-friendly