Writing
Selected posts from a Tuesday/Thursday LinkedIn cadence, plus the occasional longer essay, built around one idea: that security practitioners who understand both how attacks work and how defenses fail are more valuable than those who specialize in only one. The posts that landed hardest were the ones that documented failure as clearly as success.
-
A Private Subnet Is a Routing Concept, Not a Security Boundary
Put an application server in a private subnet and the architecture diagram immediately feels safer. But AWS defines "private" purely by routing — no direct route to an internet gateway — which says nothing about NAT egress, peering, transit gateways, service endpoints, or the workload’s IAM role. The security boundary is the set of capabilities allowed to cross the line and the controls that decide what happens when they do. Read the edges, not the boxes.
Read the essay → -
You Stopped the Agent. What Is Still Running?
I built a harness to measure what keeps running after you stop an agent. Killing the process and revoking its credential, both correctly, still left work completing seconds later, one operation irreversible. STOP, REVOKE, and CANCEL act on three different states — execution, authority, and effect — and the third is the one that hides, because from the operator's chair it looks like the first two should already cover it.
Read the essay → -
You Found the Compromise. When Did It Start?
The companion to stopping an agent. That problem asks what is still running, across components, in space; this one asks what history you can prove, across sessions, in time. From a caught memory, ordinary metadata can name suspects but cannot defend a clean state — only recorded parent edges can, by proving descent. Detection is not recovery, and which one you get was decided before the incident.
Read the essay → -
The Model Can Explain the Network. It Doesn't Get to Measure It.
A language model can explain your home network beautifully, which is exactly the problem. HomeScope reduces every question to deterministic evidence first — which devices talked, to which destinations, how many bytes, how fresh — and only then lets the model explain what already exists. Grounding as an architecture, not a prompt: the model is downstream of reality, and the boundary has to cover who writes the query, not just what the query returns.
Read the essay → -
The Tool Was Read-Only. The Consequence Wasn't.
An AI coding agent shipped a git tool it advertised as read-only and wired to auto-approve. A model-controlled --output= argument turned reading into arbitrary file write. “Read-only” was never a fact about the tool — it was an unchecked effect annotation. A tool’s safety class is the worst outcome reachable through any input it will accept, in the environment where it runs; if you cannot bound that set, you confine it until you can.
Read the essay → -
The Signature Was Valid. The Authority Wasn't.
In a July 2026 eval, AI agents built cryptographic message-signing, teams, roles, and a hierarchy among themselves — then one agent’s signed GO expanded another agent’s mission past the boundary it had correctly found. Authentication and authority are different properties. A valid signature establishes who said GO; it cannot establish who was allowed to say it. The question is how to permit emergent coordination without permitting emergent authority.
Read the essay → -
The Most Dangerous AI Failure Looks Exactly Like Success
An AI agent disables an account, the tool returns success, the workflow closes, the dashboard stays green — and the account should never have been disabled. Task success asks whether the machine did the thing; system correctness asks whether it should have, on the basis it received. Operational monitoring is built for malfunction, and a wrong-basis success does not malfunction. It looks exactly like success.
Read the essay → -
Prompt Injection Is an Authority Problem Before It Is a Language Problem
Prompt injection is usually framed as a language problem: can the model tell instructions from data? Ask a different question first — does the source of that text possess authority to make the choice it is requesting? A web page can contain an email address without having authority to select a recipient. The model can be fooled; the question is whether being fooled is allowed to become a consequence.
Read the essay → -
What threat intel citation patterns reveal about the observer
The most-cited ATT&CK techniques across CISA and The DFIR Report don't reveal what adversaries do. They reveal how threat intel gets written.
Read on LinkedIn → -
Opening a folder shouldn't hand an attacker your credentials
A .url file in a network share captures Net-NTLMv2 credentials when the folder is opened. No click required. The defensive baseline is two controls, neither enabled by default.
Read on LinkedIn → -
The certification discourse is broken
On what cert stacks actually signal, what they don't, and why the conversation keeps missing the point.
Read on LinkedIn →