Writing
Selected posts from a Tuesday/Thursday LinkedIn cadence, plus the occasional longer essay, built around one idea: that security practitioners who understand both how attacks work and how defenses fail are more valuable than those who specialize in only one. The posts that landed hardest were the ones that documented failure as clearly as success.
-
Everyone Picks Seven
I asked five independently built language models to pick a random number, 60,500 answers in all, and measured the thing the usual version of this observation skips: not whether each model is biased, but whether they are all biased the same way. The first is a quirk. The second is a security property. At 1 to 10 a single fixed guess of 7 predicts 86.6% of the sampled answers, and knowing which of the five you face buys an attacker nothing. The real cross-model agreement is more than ten times stronger than an equal-but-unrelated bias would produce, and you cannot temperature your way out of it. Diversity is a security control only when failures are independent — this is the measurement that says check first.
Read the essay → -
The Patch Window Isn't the Only Clock
Microsoft's 2026 report clocks exploitation at well under 24 hours against 30–60 day remediation, and the right reaction is to patch faster. But that is one clock. When an attacker moves from a vulnerability into a valid account, patching closes the door behind someone already inside — the authentication still works, the token is still real. The second clock is revocation latency: how long compromised authority keeps authorizing new work after you try to revoke it, across sessions, tokens, service principals, delegated roles, and credentials minted from the original identity. Disabling the account is the beginning of containment, not the end.
Read the essay → -
How Do You Govern a Model You Cannot Govern?
Anthropic's GLM-5.3 evaluation shows real offensive capability in an open-weight model and safeguards an operator can strip — refusals bypassed 64 percent of the time with a cover story, 92 percent with reasoning prefill, 100 percent after weight modification. Once someone owns the weights, the refusal is theirs to remove, so the final enforcement point cannot live inside the model. It has to live where the model's output becomes consequence: the network, the credential broker, the deployment system, the API. You govern a model you cannot govern by refusing to make the model the place where governance has to succeed.
Read the essay → -
The Email Passed Authentication. So Did the Fraud.
An invoice passed SPF, DKIM, and DMARC, scored zero on spam, and carried no malware, delivered through legitimate Zoho infrastructure. It was still fraud. The controls did exactly what they were designed to do; the mistake is letting a successful control imply something it never established. Authentication proves who sent a message, not that its claim is true, and the more an attacker works through legitimate infrastructure instead of impersonating it, the more that line matters.
Read the essay → -
A Private Subnet Is a Routing Concept, Not a Security Boundary
Put an application server in a private subnet and the architecture diagram immediately feels safer. But AWS defines "private" purely by routing — no direct route to an internet gateway — which says nothing about NAT egress, peering, transit gateways, service endpoints, or the workload’s IAM role. The security boundary is the set of capabilities allowed to cross the line and the controls that decide what happens when they do. Read the edges, not the boxes.
Read the essay → -
You Stopped the Agent. What Is Still Running?
I built a harness to measure what keeps running after you stop an agent. Killing the process and revoking its credential, both correctly, still left work completing seconds later, one operation irreversible. STOP, REVOKE, and CANCEL act on three different states — execution, authority, and effect — and the third is the one that hides, because from the operator's chair it looks like the first two should already cover it.
Read the essay → -
You Found the Compromise. When Did It Start?
The companion to stopping an agent. That problem asks what is still running, across components, in space; this one asks what history you can prove, across sessions, in time. From a caught memory, ordinary metadata can name suspects but cannot defend a clean state — only recorded parent edges can, by proving descent. Detection is not recovery, and which one you get was decided before the incident.
Read the essay → -
The Model Can Explain the Network. It Doesn't Get to Measure It.
A language model can explain your home network beautifully, which is exactly the problem. HomeScope reduces every question to deterministic evidence first — which devices talked, to which destinations, how many bytes, how fresh — and only then lets the model explain what already exists. Grounding as an architecture, not a prompt: the model is downstream of reality, and the boundary has to cover who writes the query, not just what the query returns.
Read the essay → -
What threat intel citation patterns reveal about the observer
The most-cited ATT&CK techniques across CISA and The DFIR Report don't reveal what adversaries do. They reveal how threat intel gets written.
Read on LinkedIn → -
Opening a folder shouldn't hand an attacker your credentials
A .url file in a network share captures Net-NTLMv2 credentials when the folder is opened. No click required. The defensive baseline is two controls, neither enabled by default.
Read on LinkedIn → -
The certification discourse is broken
On what cert stacks actually signal, what they don't, and why the conversation keeps missing the point.
Read on LinkedIn →