Mike Elkins

“Mike Elkins is one of the rare cybersecurity strategists who understands what most governance frameworks systematically ignore: the cognitive domain is where governance actually breaks. For 27+ years, Mike has been bridging behavioral science and cybersecurity—naming the gap that most CISOs, CROs, and governance architects refuse to acknowledge. That gap cost Coinbase $100M+ in May 2025. Governance Debt in the Cognitive Domain Traditional GRC frameworks treat humans as variables to manage. But governance debt emerges when there's a chasm between what governance says it protects and what it actually prevents when human incentives, organizational pressure, and cognitive vulnerability intersect. Mike's three-domain framework (cyber, physical, cognitive) asks uncomfortable questions: What stops a well-compensated engineer from opening a back door? What prevents coercion of someone who has authorization? These aren't technical problems—they're cognitive problems that technical controls cannot solve. Why Coinbase Mattered When the Coinbase breach hit in May 2025, the attack was cognitive: threat actors bribed overseas contractors to weaponize legitimate access. They broke through psychological barriers using financial incentives, isolation, and low detection risk—exactly the cognitive vulnerabilities most governance frameworks assume exist but rarely engineer. Real Application: Sacramento County When I architected governance systems at Sacramento County (SHIE), Mike's framework shaped our insider threat mitigation: • Behavioral monitoring detecting coercion indicators (isolation, financial pressure, behavior changes)—not just malicious intent. • Governance design acknowledging humans aren't robots: structural protections (segregation of duties, mandatory vacation rotations) that make deviation costly regardless of cognitive state. The Insight Governance debt isn't about inefficient processes—it's the gap between what frameworks assume about human behavior and what humans actually do when incentives change, pressure increases, or isolation deepens. Organizations ignoring the cognitive domain are vulnerable to adversaries who understand psychology better than they understand security. Mike's insistence on treating the human element as foundational is redefining what responsible governance looks like. As adversaries weaponize behavioral science (deepfakes, AI-powered profiling), frameworks treating the cognitive domain as "training and awareness" will continue to fail. Bottom Line Mike understands the human layer where governance breaks. If you're building governance systems (AI, privacy, compliance, insider risk), his perspective is essential. His work is foundational for Courageous Governance—governance that works under pressure, not governance that looks good on paper. Recommended for: CISO roles, Board advisory, Governance architecture, Enterprise risk management, AI governance, Insider threat programs.”

“Mike demonstrated strong technical skills and initiative to pursue change and continuous improvement during the time we worked together at Siemens/Cerner.”