Jacob Horne

About

I research how cybersecurity policy is created, implemented, and verified.I'm particularly interested in what happens next: the consequences, contradictions, and incentives that aren't obvious from reading the policy itself. My work has taken me from a major defense contractor to the NIST Manufacturing Extension Partnership and now into the Defense Industrial Base during one of the biggest cybersecurity policy transitions in DoD history. I spend my time reading statutes, regulations, congressional reports, GAO reports, DoD Inspector General reports, technical standards, enforcement actions, and acquisition data. Then I connect the dots and explain what happens next and what those changes mean in practice.Some people know me as the "CMMC Town Crier." In reality, I've always been more interested in the policy, governance, and incentives behind the headlines than the headlines themselves. The cybersecurity problems that interest me most sit at the intersection of technology, governance, contracting, and risk.The recurring theme in my work is simple: cybersecurity compliance is not just a technical problem. It is a leadership, contracting, evidence, scoping, and accountability problem.