Articles.
Thirty years of security leadership leaves you with opinions. Here are mine, written down. The research pieces carry sources you can check; the shorts get you oriented in a few minutes. Either way, each one ends with something you can do on Monday, and if your problem can't wait for an article, ask me directly.
Who's writing this
I've been in and out of academia for years. Multiple undergraduate degrees, from the humanities through cybersecurity to law enforcement. Scores of industry certifications, up through instructor, instructor-trainer and instructor-examiner. Several postgraduate degrees, including a couple of master's, went to law school, and my PhD is in computer engineering with the research heavily centred on cybersecurity, AI, and the criminal use of technology. Along the way I've built curriculum for major private and public organisations, and served as the subject-matter expert for blue-chip companies, startups, high-net-worth individuals, NGOs, and US and allied governments from the municipal level to the national.
Which means I'm probably about four years behind our adversaries. Tongue firmly in cheek.
Most subjects are covered on one page from five angles, in this order: where I'd start, where plans fail, beyond the jargon, what good looks like, and the call leaders can't dodge. Jump to the one you need.
Start here
-
Before You Give an AI Agent Permission to Act
AI agents can take action, not just answer questions. I examine permissions, tool access, human oversight and what it takes to keep automation accountable.
-
Before an AI Agent Can Act, Decide What It Must Never Touch
What I look at in AI agent permissions, the decisions it forces, and what credible evidence looks like before you spend.
-
Can You Trust a Signed Webhook to Update a Business Record?
Review webhook trust beyond signatures: tenant binding, replay, duplicate effects, event ordering and recovery after missed notifications.
-
Do Private Endpoints Prevent Cloud Data Exfiltration?
Assess private endpoints against destination ownership, service permissions and managed exports, then test the cloud data paths an egress firewall misses.
-
Does Privileged Access Really End When the Timer Expires?
Verify that temporary admin access ends across role assignments, cached decisions, sessions and delegated credentials while ordinary access keeps working.
-
Does the Vulnerable Component in Your SBOM Affect Your Service?
Trace an SBOM vulnerability match to deployed software, affected versions, execution paths and VEX evidence before closing or escalating the finding.
By subject
- Incident response4 research · 25 shorts
- Security operations7 research · 15 shorts
- Adversary emulation0 research · 11 shorts
- Threat intelligence and OSINT1 research · 11 shorts
- Forensics and investigation1 research · 11 shorts
- AI security6 research · 18 shorts
- Critical infrastructure4 research · 12 shorts
- Cloud security2 research · 11 shorts
- Network security1 research · 11 shorts
- Identity and zero trust6 research · 13 shorts
- Application security2 research · 10 shorts
- Software engineering4 research · 12 shorts
- Privacy and cryptography3 research · 11 shorts
- Fraud and phishing0 research · 11 shorts
- National security and cyber conflict0 research · 11 shorts
- Governance and risk8 research · 15 shorts
- Executive leadership3 research · 23 shorts
- Cyber economics0 research · 11 shorts
- Operational resilience2 research · 12 shorts
- Education and training6 research · 15 shorts