A publication for practitioners inside the gap
Technology moves fast. The rules, oversight, and accountability meant to keep it in check don't. Vordan exists to close that gap.
About
There is a gap between how fast technology moves and how slowly the systems meant to govern it respond. You see it when a new AI model ships and the compliance team is still writing the policy for the last one. You see it when a zero-day drops and the audit framework being used to assess it was written before the threat existed.
That gap is not a bug. It is a feature of how institutions work. But somebody has to write about it honestly, aimed at the people actually operating inside it.
That is what Vordan is. A publication for security professionals, risk analysts, compliance leads, and technologists who live at the intersection of advancing capability and lagging governance. Not for executives who need a briefing. For practitioners who need a reference.
Vordan covers cybersecurity, AI governance, post-quantum cryptography, open source, and digital sovereignty — not as separate beats but as connected pressure points in a single systemic problem.
The doctrine is Accountable by Design: governance architecture built in before deployment, not retrofitted after failure.
Founded by Dominick Costa, a New York-based GRC practitioner and operations leader, Vordan launched in April 2026.
The Framework
The Vordan framework identifies the six structural properties that governance systems must possess to close the accountability gap. Organizations that get governance right didn't stumble into it. They built it on purpose, before the audit, before the breach.
01
Every decision, action, and output produced by a system or agent must be traceable to an accountable human or organizational owner. Without traceability, accountability is performative.
02
Governance structures must be designed to anticipate categories of risk before they materialize, not respond to incidents after they occur. Reactive governance is governance theatre.
03
The depth of oversight must be proportional to the potential impact of the technology being governed. Not every tool requires the same scrutiny. Misjudging proportionality in either direction creates gaps.
04
Governance cannot be periodic when risk is continuous. Systems that drift, adapt, and evolve require oversight that operates at the same cadence — not annual checkpoints that snapshot a moving target.
05
Risk must be expressed in language that decision-makers can act on. Technical complexity that cannot be translated into governance terms does not reduce risk — it hides it from the people responsible for managing it.
06
Identifying a gap without a defined response mechanism is observation, not governance. The accountability loop is only closed when the people who find a problem have the authority and the pathway to fix it.
Glossary
Precision of language is a governance property. Vordan maintains a working glossary of terms used in the publication. These are not standard definitions — they are the definitions that matter for practitioners operating inside the accountability gap.
The Publication
Vordan publishes every Sunday and Wednesday. The Accountability Report is the full analysis — one governance failure examined thoroughly. The Gap Alert is the urgent signal — something just happened, here is why it matters.
Why the accountability gap between technical capability and governance is not a bug — it is the defining feature of every technology cycle. And why this cycle is different.
Read the issue →The accountability gap just went machine speed. Autonomous agents that detect, hunt, and respond in seconds. The governance architecture to hold them accountable hasn't been built.
Read the issue →A third-party integration failure that exposed the structural gap between vendor trust and governance oversight. What it means for organizations running on federated identity.
Read the issue →Harvest now, decrypt later. The post-quantum cryptography governance failure. OMB missed its first deadline. The adversary storing your 2024 traffic doesn't need to understand ML-KEM. They need storage.
Read the issue →The Publication
Every Sunday and Wednesday. No noise. No vendor content. Analysis written for the people who have to act on it.
Free to start. Written for practitioners.
Contact
Vordan is written by Dominick Costa, a New York-based GRC practitioner, cybersecurity analyst, and operations leader. For editorial inquiries, speaking, or governance readiness conversations, reach out directly.
Vordan offers pre-audit governance readiness assessments and post-audit accountability gap reviews for organizations that want to close the gap before the failure, not after it.
Inquiries are handled directly and confidentially.