Oritse J. Uku
Resilience Is Designed. Expertise Is Apprenticed.
Two arguments about institutional capability: how systems are designed to hold, and how the people who hold them are made.
Oritse J. Uku has spent 25 years on the operating side of institutional risk, from U.S. Army intelligence to global markets to enterprise cyber and the boardroom. At Citigroup he oversaw threat investigations across fusion-center teams in New York, Budapest, and Singapore, authored the bank’s third-party incident-response playbook, and built its first cloud incident-response program.
- Former board-appointed CISO of two Northwestern Mutual subsidiaries: a federally chartered savings association, and a registered broker-dealer.
- Former U.S. Army intelligence officer. Boston College (BA, MBA) and Columbia University (MIA). CISO executive certificate, Carnegie Mellon Heinz College.
- Author of Taking the Boy Scouts to War. His writing has appeared in Forbes Councils.
Two arguments
The institutional layer
Resilience Operating Discipline
Regulation is the ground condition, not the adversary. Resilience is the discipline that keeps an enterprise inside tolerance through severe but plausible disruption, and architecture decides whether it does.
The discipline →The human layer
The Pipeline Paradox
Agentic AI is automating the entry-level tasks of cybersecurity. Those tasks were the profession’s only apprenticeship. Oritse J. Uku holds a seat on the 7AI CISO Advisory Program, where agentic security is being defined as a category.
The reference page →The two are one problem at two altitudes. An institution performs under stress only if its people can, and the mechanism that produced those people is the one currently being automated.
The body of work
Featured writing, in reading order.
Four essays, sequenced. The regulatory frame first, because it is the brief most institutions are failing to read. Then the architectural depth that frame demands. Then the identity frontier where the next decade of liability will be settled. Then the evidence question that follows all three.
Operational Resilience Is Becoming the Global Regulatory Baseline
The regulatory frame (DORA, PRA, and SEC) as the ground condition any enterprise-scale CISO now works inside. Read this first.
Regulation is the ground condition, not the adversary. The architectures that read it as a brief will age the best.Read the lead essay →
IV. Evidence
Evidence of Resilience: How CISOs, CIOs, and CROs Demonstrate Continuity Under Stress
Essay · December 2025
Newsletters
Becoming Cyber
For the person at the door, and the people who decide whether it opens. It runs in seasons rather than as a feed. Season One is publishing now, biweekly on Thursdays.
Becoming Cyber →
CyberFuture
Institutional governance analysis for CISOs and boards. Issues appear when a development warrants interpretation.
CyberFuture →Speaking and press
Evanta New York CISO Executive Summit, November 2023. NYC Transformation Assembly CXO panel, October 2024.
Press and speaking enquiries: media@oritseuku.com
Where these arguments came from, and what they are built on. Read the full background →