Definitions Series
What is a Tabletop Exercise? A Complete Guide
A tabletop exercise stress-tests your incident response plan without real consequences. Learn how they work, who attends, what you get, how often to run.
Author
Mike Piekarski
Founder & Principal Consultant
Mike started his career in 2006 in systems administration, progressing through network engineering before building a passion for code, automation, and security. He began penetration testing in 2010 and hasn't looked back. Over 20 years he's managed enterprise security environments at organizations like Computer Sciences Corporation and Comcast, served as Director of Cybersecurity at a regional VAR/MSP, and worked at boutique cybersecurity firms. He co-founded Breach Craft with colleagues built over that career, to deliver the level of service they always wished they'd received. Mike sits on the board of the Lehigh Valley Chapter of the Cloud Security Alliance and regularly participates in local, regional, and national cybersecurity events.
CISSP
Articles by Mike
22 articles published
Definitions Series
Penetration Testing vs. Vulnerability Assessment: Which Do You Need?
Vulnerability assessments find known issues. Penetration tests prove what an attacker can actually do. Here's how to decide which one your organization needs.
Strategy
How Much Does Penetration Testing Cost?
Penetration testing costs range from $5,000 to $100,000+. What drives the price, what to watch for in proposals, and how to scope an assessment that fits your budget.
Strategy
CMMC 2.0 Compliance: 8 Months Until the Deadline. What Defense Contractors Must Do Now
CMMC 2.0 compliance is mandatory by Oct 2026. Learn what defense contractors need to do now to meet DoD cybersecurity requirements. Get a free assessment.
Strategy
Cyber Insurance Requirements: What Carriers Want
Only 1 in 4 cyber insurance claims paid out in 2024. Learn what carriers like Coalition and Travelers require in 2026 before your renewal.
Why BreachCraft
AI Went From Chatbots to Agents. Your Security Didn't.
Enterprise AI evolved from chatbots to agents with system access. Shadow AI breaches now cost $4.63M. Here's how to assess what you're actually exposed to.
Why BreachCraft
The 5 Gaps We Find in Almost Every Security Program
After hundreds of gap assessments, the same 5 security program gaps keep showing up. Here's what they are, why they persist, and how to actually fix them.
Strategy
Cybersecurity for K-12 School Districts
How school districts can build incident response plans, protect student data under FERPA, and meet state cybersecurity mandates. Practical steps for IT leaders.
Strategy
How to Turn Cybersecurity Awareness Into Action: 3 Moves to Make Before Year-End
Cybersecurity awareness campaigns often fail to translate into sustained action. Here are three concrete steps to take before year-end to strengthen your security posture.
Definitions Series
AI Security Risks Your Current Framework Doesn't Cover
A structured framework for assessing security risks associated with artificial intelligence systems, covering OWASP LLM Top 10 and NIST AI RMF.
Definitions Series
Your WiFi Is Probably Less Secure Than You Think
Learn how wireless penetration testing evaluates your wireless infrastructure security using the same techniques employed by malicious attackers.
Definitions Series
Do You Actually Need a Full-Time CISO?
Learn how Virtual CISO services provide experienced security leadership on a fractional basis, helping organizations build mature security programs without the cost of a full-time executive.
Why BreachCraft
What a Part-Time CISO Actually Does (And Doesn't Do)
Virtual CISO services have become common, but quality varies significantly. Learn how Breach Craft's collaborative, team-based approach gives you a full security team's perspective, not just one consultant's opinion.
Why BreachCraft
The Web App Vulnerabilities Scanners Keep Missing
Web application security testing has become commoditized, but significant quality variations remain. Learn what sets Breach Craft's approach apart.
Definitions Series
Web Application Penetration Testing: Uncovering Critical Vulnerabilities Before Attackers Do
Learn what web application penetration testing is, why your organization needs it, and what to expect from a thorough security assessment.
Definitions Series
What is a Gap Assessment? Mapping Security Posture to Industry Standards
Learn how gap assessments compare your current security practices against established frameworks like NIST, CIS, and ISO 27001 to identify improvement opportunities.
Why BreachCraft
Beyond the Automated Scan: How Breach Craft's Human-Driven Penetration Testing Uncovers What Others Miss
Genuine security assessment requires human expertise, not just automated tools. Learn how Breach Craft's methodology finds vulnerabilities others miss.
Definitions Series
What is Penetration Testing? A Buyer's Guide
Learn what penetration testing is, why your organization needs it, how to choose the right provider, and what to expect from the assessment process.
Thought Leadership
Building Your Security Program: Lessons from the Weight Room
Drawing parallels between strength training and cybersecurity program development: structured approaches, progressive overload, and consistent improvement.
Definitions Series
CIS Controls: Where Most Organizations Fall Short
Learn how CIS Controls v8 gap assessments help organizations evaluate and systematically improve their cybersecurity posture through Implementation Groups.
Strategy
Compliance vs. Security: Why the Bare Minimum Isn't Enough
Understanding the difference between regulatory compliance and genuine security, and why meeting minimum standards doesn't guarantee protection.
Industry News
Reflections on the CrowdStrike Outage: Strengthening Incident Response and Business Continuity Plans
The CrowdStrike outage affecting 8.5 million computers offers critical lessons for incident response and business continuity planning.