Hello, world

Most of what gets written about security is ceremony. Frameworks, maturity models, dashboards that measure how much process exists rather than whether an attacker would get in. This blog is the other thing.

I write about three overlapping areas:

• Hands-on security. Offensive and defensive technique, tooling, and what actually happens when you point them at real systems.
• AI and security. Where models help defenders, where they help attackers, and where the hype is just hype.
• Leadership. Running security work from first principles, with the adversary as the only stakeholder that matters.

A quick sanity check that code blocks render properly:

def defend(system, adversary):
    # ponytail: the only metric that counts
    return adversary.cost_to_compromise(system) > adversary.budget

Subscribe via RSS if you want the posts and nothing else.