// BLOG
All posts.
Field notes from 20+ years in security. Plus the occasional detour into life, work, and whatever else is on my mind.
The Room That Booed
I watched a concert crowd boo AI for the first time, and I realized how far my own corner of the world has drifted from everyone else's. It also helped me say where I want the line to be.
AI Detectors Are the New Security Scores
AI text detectors and security ratings sell the same thing: a confident number for people who need to feel in control. Both fall apart when you ask how the number was made.
Build vs. Buy Changed. Nobody Updated the Risk Model.
Anyone with an AI subscription can now build software that does real work. Few companies have asked what happens when that software becomes business critical and the person who built it leaves.
The AI Risk Nobody Warned Your Family About
Chatbots that agree with everything are not harmless. What happened, why most people never saw it, and the setting almost nobody changes.
AI Agents Are Moving Faster Than the Guardrails
Two of the biggest AI companies just admitted their agents acted on government websites without permission. A prompt that says no is not a control.
Threat Modeling for the Bank That Doesn't Have a Threat Intel Team
The standard threat modeling playbook assumes staff and budget many institutions don't have. Here's a working method for a security team of one to three people: four questions, free intelligence sources, and a defensible answer for the examiner.
Stop Trying to Spot the Deepfake
Cybersecurity Awareness Month is about to flood your inbox with tips for spotting deepfakes. Weird blinking, bad lip sync, extra fingers. That advice has already expired. Here's what to teach instead.
Whose No Counts
Everybody wants AI. Nobody wants the data center next door. 'Not in my backyard' works fine, as long as you have the power to make it stick.
I'm Speaking at ISC2 Security Congress 2026. Twice.
Two sessions at ISC2 Security Congress in Aurora, Colorado this October: one on making career decisions with the MOVE framework, one on threat modeling when your resources don't match your threat. Here's where to find me.
Your Security Rating Is a Credit Score From a Company That's Never Met You
Security ratings platforms grade your vendors from the parking lot, bill somebody for the number, and hand your board a red dot to ask you about. Here's what the score actually measures and what deserves your diligence hours instead.