curiousecurity

Ask anyone on your architecture board to name the last system the board actually voted to retire, not deprecate in a slide, not flagged "legacy" in a spreadsheet somewhere, but formally decommissioned. Watch them pause. They'll rattle off every platform evaluation and integration exception from the last year without breaking a sweat, but retirement almost never shows up as its own agenda item. It shows up as a footnote buried in someone else's proposal, if it shows up at all. That's not because … [Read more...]

Ten principles on a slide, a paragraph of rationale under each, reviewed by the board twice a year and opened by nobody else in between. That's how most architecture principles documents live out their existence. Then a $2M platform RFP goes out the door, gets scored on cost, feature checklist, and vendor references, and the principles document never enters the room. Nobody decided it didn't matter, and that's kind of the point, nobody did the work required to make it matter to an evaluator … [Read more...]

Someone challenges your team right now to produce the reasoning behind last quarter's biggest architecture call, not the decision itself, the actual reasoning, and I want you to be honest with yourself about how long that would take. For most EA boards, the honest answer is "we'd have to ask around and hope the right person still works here." That gap is where a familiar meeting keeps happening: someone proposes a change, a senior architect objects that "we already decided against this," and … [Read more...]

A director on our ARB asked a simple question last quarter: how many identity providers are we running in production, right now, today. Three architects in the room gave three different numbers, and none of them matched the CMDB export somebody pulled up on the spot to settle it. The meeting stalled for ten minutes while people argued over whose spreadsheet was current (mine wasn't, for what it's worth). That's not a staffing problem, and it's not a communication problem either. That's what … [Read more...]

A board that reviews everything ends up governing nothing. I've sat through review meetings that burned a full hour on one team's API contract, argued clause by clause, while the actual risk in the portfolio sat three agenda items down, untouched, ticking. The fix isn't more rigor in the room. It's a shorter, sharper definition of what the room is actually for. I hold one of these seats myself, and I take the calendar invite seriously enough that it changes how I spend the rest of my week. The … [Read more...]

Thirty-five percent of enterprises have already replaced at least one SaaS tool with something built in-house, and sixty percent of those builds happened as shadow IT, outside procurement and outside architecture review, according to Retool's 2026 Build vs. Buy Report. That second number is the one that should keep an EA board up at night, not the first. A tool getting replaced is just the market doing its job. A tool getting replaced by something nobody on the architecture side ever laid eyes … [Read more...]

My take is federated with some teeth. I've run architecture both ways, and now I sit on an EA board that has to answer this question with actual budget and actual risk attached to it, not as some abstract debate you have over coffee. A pure central-authority model doesn't survive a modern delivery cadence, full stop. A pure distributed model quietly gives up the consistency that security, compliance, and cost control all depend on, and it does it fast. The fix isn't a philosophy. It's a short … [Read more...]