Writing

Insights

Long-form points of view. Shorter notes live on the blog.

CISO2026-06-21 · 8 min
Shrinking the Blast Radius
You cannot guarantee a breach will not happen. You can decide how much it costs when it does. Encryption, tokenization, and minimization are blast-radius controls, not prevention controls.
CISO2026-06-21 · 8 min
Rebuilding the SOC for an AI-Speed Adversary
Attackers compressed breakout time to minutes and deleted the cost of expertise. You cannot defend a machine-speed adversary at human speed.
AI2026-06-21 · 7 min
Securing the Enterprise Rush to GenAI
Adoption is outrunning governance by a wide margin. The defining risk of this era is not an exotic zero-day. It is the debt between how fast we deploy AI and how slowly we learn to control it.