# Tim McAllister — The operating side of digital trust > Public writing and field guides on device and machine identity, software assurance, cryptographic change, and AI trust in practice. Tim McAllister is Regional Field CTO at DigiCert. Personal views. This site does not speak for DigiCert or for the authorities and vendors it references. This is an optional, experimental index following the llms.txt proposal (https://llmstxt.org/). It is not a crawler permission, a reuse license, a search-ranking directive, or a guarantee of inclusion. Consult robots.txt for crawler rules. Subscriber-only material and protected report versions are unavailable through this index. Use the canonical page for context and citation. Article dates are original publication dates; guide review dates are not publication dates. Preserve source qualifications and distinguish reported facts, vendor or researcher claims, and the author's analysis. ## Start here - [Research & source index](https://www.timmcallister.io/research): Scope, author disclosure, research topics, and citation guidance. - [Public discovery catalog](https://www.timmcallister.io/discovery.json): JSON summaries, canonical URLs, original publication dates, guide review dates, section anchors, and references. - [About Tim McAllister](https://www.timmcallister.io/about): Author background and current role. ## Subjects - [Device & machine identity](https://www.timmcallister.io/subjects/device-machine-identity): Identify, update, isolate, and recover the systems you operate. - [Software assurance](https://www.timmcallister.io/subjects/software-assurance): Connect product evidence with what buyers and regulators need. - [Cryptographic change](https://www.timmcallister.io/subjects/cryptographic-change): Find the dependencies before certificates and algorithms change. - [AI trust in practice](https://www.timmcallister.io/subjects/ai-trust-in-practice): Know what an agent can do, what constrains it, and what can be proved. ## Field guides - [Device identity from manufacture to retirement](https://www.timmcallister.io/guides/device-identity-lifecycle): A practical architecture for provisioning, attestation, signed updates, recovery, and evidence across the life of a connected product. Reviewed 2026-09-05. - [When quorum closes the conversation too early](https://www.timmcallister.io/guides/trust-list-approval): A proposed approval pattern that preserves a binding decision and the full review record for trust lists, signing releases, and other consequential changes. Reviewed 2026-09-05. - [Software assurance: make the product evidence usable](https://www.timmcallister.io/guides/software-assurance-cra): A practical operating model for secure releases, vulnerability response, and EU Cyber Resilience Act readiness. Reviewed 2026-09-05. - [Funding digital trust with your own evidence](https://www.timmcallister.io/guides/funding-digital-trust): Build a decision around operating costs, required capabilities, and testable risk reduction. Make every assumption visible. Reviewed 2026-09-05. - [PQC readiness: the first five actions](https://www.timmcallister.io/guides/pqc-first-five-actions): Five practical actions that turn post-quantum planning into an inventory, tested deployment paths, and supplier commitments. Reviewed 2026-09-05. - [PQC migration: build the ability to change cryptography](https://www.timmcallister.io/guides/pqc-migration): A practical architecture and roadmap for moving from an algorithm inventory to tested post-quantum deployment. Reviewed 2026-09-05. - [PKI operations: from renewal alerts to a managed service](https://www.timmcallister.io/guides/pki-operations): Build certificate operations that can handle shorter lifetimes, changing trust policies, and the next algorithm transition. Reviewed 2026-09-05. - [AI agents need authority you can constrain and revoke](https://www.timmcallister.io/guides/ai-agent-trust): A field brief on workload identity, delegated permissions, runtime policy, and the evidence needed when an agent gets something wrong. Reviewed 2026-09-05. - [An operating model for production AI security](https://www.timmcallister.io/guides/ai-security-operating-model): Connect model releases, agent authority, data provenance, and runtime evidence so an AI system can be evaluated, constrained, and stopped. Reviewed 2026-09-05. ## Public feeds, data, and report information - [Writing RSS feed](https://www.timmcallister.io/feed.xml): Public article titles, summaries, original publication dates, and canonical links. - [AI cybersecurity incident dashboard](https://www.timmcallister.io/ai-incidents): Curated public reports, disclosed security research, evidence qualifications, outcomes, and editorial lessons. - [AI incident world map](https://www.timmcallister.io/ai-incidents/map): Zoomable affected-region map with documented geography, source evidence, and an explicit list of reports without confirmed locations. - [Incident register methodology](https://www.timmcallister.io/ai-incidents#methodology): Coverage, disclosure dates, evidence limits, and the distinction between observed incidents and demonstrations. - [AI incident JSON dataset](https://www.timmcallister.io/ai-incidents/data.json): The public incident register with its source links and review metadata. - [AI incident RSS feed](https://www.timmcallister.io/ai-incidents/feed.xml): Public entries from the AI incident register. Reader instructions explain RSS and provide the feed address. - [Forcing Function Calendar](https://www.timmcallister.io/calendar): Dated digital-trust requirements and planning events with source links and scope notes. - [AI Trust Market Report](https://www.timmcallister.io/ai-trust-market-report): Public report landing page. Subscriber-only report content is outside this catalog. ## Optional - [Writing archive](https://www.timmcallister.io/writing): Public essays; the JSON catalog provides each title, description, canonical URL, and original date. - [Contact and corrections](https://www.timmcallister.io/contact): Send a sourced correction or research inquiry. - [Crawler rules](https://www.timmcallister.io/robots.txt): Existing crawler access policy.