Writing

I built a small security lab to teach the failure modes I see most often in client work. The first real test was running it against my own production site.

Phishing-resistant passwordless auth is finally the default for humans. The same primitives — origin binding, hardware-bound keys, short-lived signed assertions — are what your AI agent needs, and almost nobody is shipping them yet.

Everyone is treating AI like a revolution. I've seen this movie before. It was called virtualization, and then it was called cloud.

The firm is a repo. The marketing is a commit. The meetings fit in the corners of a day job. Here's what the last six months taught me about building slowly.

After a decade in enterprise security, I've stopped believing in most of the perimeter. The actual perimeter is a person with a phone.