When the remediation is worse than the risk 😅

Cloud Governance and GRC aren't the same thing.

GRC documents what should happen and proves what did happen. Risk registers, control libraries, audit trails — it's a lagging indicator. The business already made its choices.

The Head of Cloud isn’t really in charge. They’re not the President. They’re the Chief of Staff. No final say, no official control. But somehow, they’re still responsible for everything running smoothly.

Everyone talks about their CNAPP and FinOps.

But visibility without governance is just a wishlist.

If you're on the cloud team, you own the bill. You're expected to explain every charge. You're responsible for every $ - because it’s easier.

Until you have a system to track and allocate spend, every cost is yours.

Tags. Accounts. Metadata. Good governance is the only way out.

The best governance ideas don’t fail because they’re flawed.

They fail because they’re abandoned.

Focus on function, not form.

(Inspired by an early morning walk across the abandoned Memphis monorail bridge.)

LLM results depend on two things:
🧠 How smart the model is
📚 How well you brief it

Model quality? That’s up to OpenAI and friends.
Context? That’s your job.

Want Jedi-level performance?
Be like Luke: bring the force and the facts.

FinOps changes happen faster than security. Why? Incentives.

Budget is your problem and opportunity.

But, security is everyone’s problem — which often means it's no one's.

Business accepts the risk. Ship it!

The toughest Cloud Governance problems aren’t technical - they’re human. Our new book How to Herd Clouds and Influence People follows Gary, a cloud architect navigating chaos, silos & shifting priorities. Feel his pain, and joy, of driving real change 👇
cloudgovernance.org/library/how-...

The Bear is a great show - complex, layered, challenging to watch. But, in what world is it a Comedy?!?

I’ve spent 13+ years deep in the weeds of cloud governance - building, breaking, fixing, and figuring it out with some of the smartest people around. We've just launched a free site packed with lessons we learned the hard way.

Check it out! 👇
cloudgovernance.org

Security, networking, compliance, FinOps — every shared service is piling on app teams with urgent must-dos. But without clear priorities, it’s just noise.

Governance isn’t about adding more alerts. It’s about helping teams know which ones matter — and what to do about them.

We chose SQL for Steampipe because developers knew it. Now there's an unexpected bonus: LLMs know it too. Meanwhile, tools with custom query languages are getting left behind.

Familiarity is more valuable than ever! 🧵

Two people, same AI tools. One says, “I can do anything now!” The other says, “I’m not sure where this leaves me.”

What's the difference? It's not skill. It's not knowledge.

It’s agency. 🧵

When I was a kid, I never knew what to call my friends’ parents - “Hi… Mr…? Steve? Sir?”

😅 Awkward.

That’s how I’ve handled SSL vs TLS for 20 years.

Let’s clear it up once and for all 🧵

Can you trademark a meme about you that someone else made up?

Angel Reese just filed to trademark “Mebounds.” It’s not a nickname. It’s a name for something she became famous for — grabbing her own rebounds.

A viral term, born online, now moving into the world of IP.

Super excited to join Turbot today looking after various things related to marketing, developer relations, and community. Going to be a great adventure working to help folks on their cloud governance journey!