Nathan Wallace

When the remediation is worse than the risk 😅

GRC says, "Show me the evidence."
Cloud Governance says, "Let's fix it."

Cloud Governance is different. It's not just describing rules — it's deploying them.
Setting guardrails, enforcing policies, nudging teams, blocking risks. It's proactive. It changes the path before the train leaves the station.

Cloud Governance and GRC aren't the same thing.

GRC documents what should happen and proves what did happen. Risk registers, control libraries, audit trails — it's a lagging indicator. The business already made its choices.

The best Cloud Directors aren’t empire-builders. They’re influence operators. Power by presence. Clout through clarity. They earn trust across engineering, security, finance, and the exec team. And they use that trust to make change happen. Quietly, but decisively.

They don’t own the budget. They don’t own the teams. They don’t get to make a decision and slam the table. But they shape the agenda. Build coalitions. Keep the big wheels turning while the chaos swirls. They know where the risk is hiding and who’s pretending it’s not.

The Head of Cloud isn’t really in charge. They’re not the President. They’re the Chief of Staff. No final say, no official control. But somehow, they’re still responsible for everything running smoothly.

Governance is the bridge between intent and execution.

It doesn’t slow teams down, it makes sure they’re building in the right direction.

You can have the right intentions: secure the cloud, reduce cost, move fast.

But without governance, things drift. Exceptions pile up. Good ideas go rogue.

Everyone talks about their CNAPP and FinOps.

But visibility without governance is just a wishlist.

If you're on the cloud team, you own the bill. You're expected to explain every charge. You're responsible for every $ - because it’s easier.

Until you have a system to track and allocate spend, every cost is yours.

Tags. Accounts. Metadata. Good governance is the only way out.

The best governance ideas don’t fail because they’re flawed.

They fail because they’re abandoned.

Focus on function, not form.

(Inspired by an early morning walk across the abandoned Memphis monorail bridge.)

LLM results depend on two things:
🧠 How smart the model is
📚 How well you brief it

Model quality? That’s up to OpenAI and friends.
Context? That’s your job.

Want Jedi-level performance?
Be like Luke: bring the force and the facts.

💯

To make security move faster, shift the perspective. Talk about their data, their systems, their risk. The moment it feels personal, it becomes a priority — just like budget.

Blow the budget? It hits your team, your goals, your bonus. Fix it and you see the win.

Fix a security issue? Best case: nothing happens. Worst case: someone else deals with the fallout.

FinOps changes happen faster than security. Why? Incentives.

Budget is your problem and opportunity.

But, security is everyone’s problem — which often means it's no one's.

Video source - x.com/salmagedone/...

Business accepts the risk. Ship it!

How to Herd Clouds and Influence People | Library | Cloud Governance When cloud architect Gary Anderson joins a major enterprise, he faces organizational politics, shadow IT operations, and division heads protecting digital kingdoms. Follow his transformation from…

The toughest Cloud Governance problems aren’t technical - they’re human. Our new book How to Herd Clouds and Influence People follows Gary, a cloud architect navigating chaos, silos & shifting priorities. Feel his pain, and joy, of driving real change 👇
cloudgovernance.org/library/how-...

The Bear is a great show - complex, layered, challenging to watch. But, in what world is it a Comedy?!?

Cloud Governance The community for Cloud Governance practitioners (aka cloud herders)

I’ve spent 13+ years deep in the weeds of cloud governance - building, breaking, fixing, and figuring it out with some of the smartest people around. We've just launched a free site packed with lessons we learned the hard way.

Check it out! 👇
cloudgovernance.org

Each shared service team brings its own tools, language, and priorities. The result is too much guidance, all at once. Governance should fix that — by creating shared priorities, clearly communicating expectations, and helping teams focus on what matters most.

That's the job.

Modern app teams already carry a massive load. They build the app, run the infra, and own the uptime. Now they’re also expected to be experts in security, networking, identity, cost — all while shipping features and staying up.

Security, networking, compliance, FinOps — every shared service is piling on app teams with urgent must-dos. But without clear priorities, it’s just noise.

Governance isn’t about adding more alerts. It’s about helping teams know which ones matter — and what to do about them.

We're entering a world where familiarity to humans AND models matters. The languages that already won developer mindshare are about to become even more valuable.

When you query infrastructure with SQL, AI can suggest optimizations, debug errors, and write new queries from schemas. Tools with custom syntax? The AI is completely useless — no suggestions, no debugging, no help.

LLMs excel with familiar languages like SQL and Python because they've seen them everywhere — decades of tutorials, docs, and StackOverflow answers have taught them to reason like experienced practitioners.

We chose SQL for Steampipe because developers knew it. Now there's an unexpected bonus: LLMs know it too. Meanwhile, tools with custom query languages are getting left behind.

Familiarity is more valuable than ever! 🧵

AI rewards curiosity, initiative, and accountability.

If you bring those, it’s a superpower.

If you wait for instructions, it feels like a threat.