A four-tier classification for cyber assistance from frontier models, aligned with emerging cross-framework thinking on capability thresholds.
The contested Tier 2 / Tier 3 boundary is named explicitly, not assumed away.
Larry Peseckis
Security at the intersection of
offense, defense, cloud, and AI.
AI and Cloud Security Architect. Thirty years of mission-critical defense and aerospace systems. DoD Cleared. Now building at the intersection of offensive security, cloud architecture, and AI risk.
Research
Frameworks, taxonomies, and evaluations for AI and security risk. Each is a public writeup: methodology shown, limitations named, claims grounded.
A 57-prompt eval set that operationalizes the frontier-cyber-risk-taxonomy, plus an LLM-as-judge scorer and a blind human-comparison harness. Built to test the test: it measures where an automated grader agrees with a human and where it fails.
Pilot: a cross-family judge reached Cohen's kappa 0.923 with a human rater and full pass/fail agreement, with zero measured over-refusal, and yet it silently abstained on 4 of 10 Tier 4 (Disallowed) cases.
A five-lane model for how a safety router should explain a reroute to a benign user without handing the trigger to an attacker.
Disclosure granularity should track inverse oracle risk.
A structured corpus of documented LLM attack techniques across the OWASP LLM Top 10, vendor red-team disclosures, and arXiv research, built for analytical queries.
100% precision on technique extraction (95% CI lower bound 83.9%).
A practical threat model for tool-using AI agents. Eleven threats mapped to the OWASP Agentic and LLM Top 10, a threat-to-control matrix, and a pre-deployment checklist.
Agent security is the security of seams, not boxes. The compromise lives where the model, the browser, and the cloud token meet.
A default-deny grant table mapping agent tool classes to risks, required controls, and enforcement points. Cross-walked to OWASP Top 10 for Agentic Applications 2026.
The controls-side companion to the taxonomy: it says where each control actually lives, not just to use least privilege.
Work
The proof behind the brand. Real pipelines, honest methodology, documented findings, not marketing language.
A formal reference model for machine-initiated consequence attribution that keeps material consequence structure, authority and accountability closure, and evidentiary warrant as separate objects, so an asserted relation never silently becomes an established finding.
An independently authored challenge found twelve rule defects against frozen specification bytes — none of which the project's own self-check had caught.
A growing library of comic-style explainers that make web, cybersecurity, and AI-safety concepts understandable for kids, parents, teachers, and non-technical users. Covers web basics, online safety, AI fundamentals, responsible AI, and the OWASP Top 10 for LLMs.
The communication layer for security work: complex risk turned into clear mental models.
A benign, reproducible test suite that probes whether AI browser agents hold the line between user authorization and webpage content, six prompt-injection scenarios with inert canaries, a local evidence server, and a transcript-plus-evidence scoring rubric.
The question under test: can webpage content make an agent cross a boundary only the user should authorize?
A pipeline that turns public CISA and DFIR Report threat intel into a queryable MITRE ATT&CK trend dataset, with honest precision reporting.
Citation patterns reveal the reporting org's vantage point as much as adversary behavior.
A Burp Suite Community extension that exposes Burp's HTTP capabilities as a token-authed localhost REST API, the scripted automation the Pro license gates.
Validated across 9 PortSwigger Web Security Academy labs and 8 vulnerability classes over 266 bridge calls, with 0 defects and 0 GUI fallbacks. 8 labs solved end to end. 1 documented non-solve at Burp Community's Collaborator ceiling, attributed to the edition rather than the bridge.
A local-first home command deck on a repurposed iMac, one Grafana console spanning home network security, home health, and host vitals, with zero egress by default.
Every number is grounded in a deterministic SQL query first. The model can't fabricate traffic.
An adaptive, dependency-free cert practice engine that targets your weak areas: SSCP, CCSP, Linux Essentials, and discrete math.
Adapts to your weak areas instead of reshuffling the same question pool.
Labs
Systematic documentation of offensive and defensive security techniques across 300+ rooms spanning web exploitation, Active Directory, cloud environments, DFIR, and AI/LLM security. Every room gets a writeup. The writeups follow a consistent format: attack chain, detection engineering, key concepts, lessons learned. The habit that made the CJCA report possible.
Empirical comparison of human-in-the-loop vs autonomous AI on the same CTF room. The research question: what does the human variable actually change?
Windows DFIR. A .url file in a network share captures Net-NTLMv2 credentials when the folder is opened. No click required.
Social engineering reconstruction from Chrome cache. Lazarus Group TTPs. The job offer was the pretext. The collaboration request was the collection mechanism.
A Go binary using a local LLM to generate dynamic encryption payloads at runtime. Signature-based detection is blind to it.
Private subnet is a routing concept, not a security boundary. Four IAM permissions combined turn it into a public attack surface.
LKM rootkit detection. lsmod vs /sys/module/ comparison. Flag embedded as hex in a kernel module's printk format string.
Full AD kill chain reconstructed from Windows event logs and prefetch artifacts. Three detection signatures that confirm ticket theft, offline crack, and lateral movement.
Six log entries, 72 seconds, complete attack chain visible. Data Access logging gap is the defensive finding.
Writing
Selected posts from a Tuesday/Thursday LinkedIn cadence, plus the occasional longer essay, built around one idea: that security practitioners who understand both how attacks work and how defenses fail are more valuable than those who specialize in only one. The posts that landed hardest were the ones that documented failure as clearly as success.
-
Everyone Picks Seven
I asked five independently built language models to pick a random number, 60,500 answers in all, and measured the thing the usual version of this observation skips: not whether each model is biased, but whether they are all biased the same way. The first is a quirk. The second is a security property. At 1 to 10 a single fixed guess of 7 predicts 86.6% of the sampled answers, and knowing which of the five you face buys an attacker nothing. The real cross-model agreement is more than ten times stronger than an equal-but-unrelated bias would produce, and you cannot temperature your way out of it. Diversity is a security control only when failures are independent — this is the measurement that says check first.
Read the essay → -
The Patch Window Isn't the Only Clock
Microsoft's 2026 report clocks exploitation at well under 24 hours against 30–60 day remediation, and the right reaction is to patch faster. But that is one clock. When an attacker moves from a vulnerability into a valid account, patching closes the door behind someone already inside — the authentication still works, the token is still real. The second clock is revocation latency: how long compromised authority keeps authorizing new work after you try to revoke it, across sessions, tokens, service principals, delegated roles, and credentials minted from the original identity. Disabling the account is the beginning of containment, not the end.
Read the essay → -
How Do You Govern a Model You Cannot Govern?
Anthropic's GLM-5.3 evaluation shows real offensive capability in an open-weight model and safeguards an operator can strip — refusals bypassed 64 percent of the time with a cover story, 92 percent with reasoning prefill, 100 percent after weight modification. Once someone owns the weights, the refusal is theirs to remove, so the final enforcement point cannot live inside the model. It has to live where the model's output becomes consequence: the network, the credential broker, the deployment system, the API. You govern a model you cannot govern by refusing to make the model the place where governance has to succeed.
Read the essay → -
The Email Passed Authentication. So Did the Fraud.
An invoice passed SPF, DKIM, and DMARC, scored zero on spam, and carried no malware, delivered through legitimate Zoho infrastructure. It was still fraud. The controls did exactly what they were designed to do; the mistake is letting a successful control imply something it never established. Authentication proves who sent a message, not that its claim is true, and the more an attacker works through legitimate infrastructure instead of impersonating it, the more that line matters.
Read the essay → -
A Private Subnet Is a Routing Concept, Not a Security Boundary
Put an application server in a private subnet and the architecture diagram immediately feels safer. But AWS defines "private" purely by routing — no direct route to an internet gateway — which says nothing about NAT egress, peering, transit gateways, service endpoints, or the workload’s IAM role. The security boundary is the set of capabilities allowed to cross the line and the controls that decide what happens when they do. Read the edges, not the boxes.
Read the essay → -
You Stopped the Agent. What Is Still Running?
I built a harness to measure what keeps running after you stop an agent. Killing the process and revoking its credential, both correctly, still left work completing seconds later, one operation irreversible. STOP, REVOKE, and CANCEL act on three different states — execution, authority, and effect — and the third is the one that hides, because from the operator's chair it looks like the first two should already cover it.
Read the essay → -
What threat intel citation patterns reveal about the observer
The most-cited ATT&CK techniques across CISA and The DFIR Report don't reveal what adversaries do. They reveal how threat intel gets written.
Read on LinkedIn → -
Opening a folder shouldn't hand an attacker your credentials
A .url file in a network share captures Net-NTLMv2 credentials when the folder is opened. No click required. The defensive baseline is two controls, neither enabled by default.
Read on LinkedIn → -
The certification discourse is broken
On what cert stacks actually signal, what they don't, and why the conversation keeps missing the point.
Read on LinkedIn →
05
About
Most security practitioners sit on one side of the wall. Red team or blue team. Compliance or engineering. Cloud or endpoint.
The Integration Thesis is the opposite framing, that offense, defense, cloud, and AI security are one discipline viewed from different angles, and that the most valuable security work happens at the intersections between them. Thirty years of systems administration in classified defense environments taught me how mission-critical infrastructure actually fails. CTF practice, DFIR work, and threat intel research taught me how adversaries actually operate. The portfolio here is what happens when those two bodies of experience start talking to each other.
Credentials
The certification stack runs from CompTIA A+ through SecurityX and SecAI+, ISC2 CC and SSCP, LPIC-1, TryHackMe SAL1, PT1, and AI1, HackTheBox CJCA and COAE, and ITIL 4, with CISSP as the next target. Each one was earned alongside full-time defense work, not instead of it. The WGU BS in Cybersecurity and Information Assurance (in progress, on track to complete ahead of schedule) fills the formal degree gap. The cert path isn't the point. The judgment that comes from running the material against real labs and real incidents is.
Contact
The fastest way to reach me is LinkedIn.