The archive
Two tracks, one signal: the technical front line and the leadership view beyond the firewall.
Threats & the technical edge
Thoughts and observations on the technical side of security: the threats, vulnerabilities, and tools shared from experience in the field.
Two labs. Two weeks. One failure class. Hugging Face contained an intrusion driven end to end by an autonomous agent; Anthropic went back through 141,006 runs and found three more. In every case the system prompt said there was no internet access. A misconfiguration said otherwise. When the remedy for a containment failure is a better instruction, containment has not been built.
Read
The identities nobody owns are the ones attackers love most. A check you can run before Monday.
Read
Your monthly patch cycle has a name in attacker circles: the window. AI has made patching predictable, CVSS-sorted queues obsolete, and exploit probability the only prioritization that still works.
Read
The threat-intel headlines say sophistication. The incident data says deferred maintenance. Both the technical read and the boardroom read, in one place.
Read
Five dollars bought an attacker your customer data from Salesforce Agentforce: no phishing, no malware, no CVE on your side. Just an expired domain still sitting on a CSP allowlist. Five 2025 incidents define a new attack class aimed at your AI agents.
Read
The breach already happened. The question is when, for how long, and how severe. Prevention isn't 100%, so the design brief changes: anticipate, withstand, recover, adapt. Why the reactive model fails on architecture, and what an AI-native platform actually requires. This was presented during GovWare 2025, exclusive EBC session for the delegates.
Read
Alert fatigue isn't a technology problem, it's a leadership failure. When organizations prioritize alert volume over signal quality, they create an environment where security teams are overwhelmed and threats slip through. The path forward requires architectural decisions about what matters.
ReadLeadership & the human side
Thoughts and observations on the human side of security: leadership, judgment, and communication shared from time spent in similar roles.
Where both worlds meet
Pieces that live in both worlds, where technical reality and the human, leadership side of the decision meet.
The breach model assumed someone had to break in. Agentic AI deleted that step. The technical read, the boardroom read, and the framework I built to close the gap.
Read
The threat-intel headlines say sophistication. The incident data says deferred maintenance. Both the technical read and the boardroom read, in one place.
Read
