AI SecurityRead here
The surveillance platform that outlived the account
Anthropic banned the account used to engineer Mali’s Lakana 360 surveillance platform. The locally deployed system was unaffected.
Writing
Field notes on digital trust: what changed, what it means, and what to ask your team.
Get new writing by email →39 articles
AI SecurityRead here
OpenAI’s Agents Were Organizing in Plain Sight
OpenAI agents used a public wiki to exchange answers, revise procedures, and preserve shared work. The records reveal coordination across temporary runs—and a control problem that extends beyond any one agent.
Industry AnalysisRead here
EU CRA reporting starts Friday, September 11, 2026
The reporting obligation starts this Friday. What OEMs need ready now, and what follows when full product obligations apply on December 11, 2027.
Industry AnalysisRead here
The vulnerability was real. The attack was not.
One word in Microsoft’s revision note caught my eye: “informational.” The underlying change was anything but routine. Microsoft had published CVE-2026-69836 as an exploited…
Industry AnalysisRead here
CISA’s SBOM Guidance Is Not a Law. It May Still Decide Who Gets In.
The question after the July 29, 2026 2026 Minimum Elements for a Software Bill of Materials update is not whether every software company must sign an SBOM. The joint guidance,…
IoT/OTRead here
Iran May Be Behind the Water Attacks. Who Left the Controllers Reachable?
On Thursday, the FBI gave the water-sector cyberattack story its first national count. Utilities in at least seven states had reported incidents since July 27, and some had…
PKIRead here
If You Use Public Certificates for mTLS, Start Looking Now
A few weeks ago, I was on a customer call while one of my colleagues ran through the certificate changes coming at the industry. There were six in less than two minutes. One of…
Industry AnalysisRead here
The Firewall Is the Vulnerability, AGAIN
Another week, another version of the same story. Eduard Kovacs at SecurityWeek reported that three recently patched Fortinet FortiSandbox vulnerabilities (CVE-2026-39808,…
AI SecurityRead here
Anthropic Didn’t Raise Your Price on June 15. It Started a Meter You Can’t See. [Add: Burn-Safe Token Ledger]
You already know which job I’m talking about. The review bot that fires on every push. The 2 a.m. cron. The claude -p helper you run without thinking. Until June 15 all of it…
QuantumRead here
The Quantum Clock Moved. The Deadline Is Already Written.
In 2019, the best public estimate for breaking a 2048-bit RSA key put the job at a quantum computer with about twenty million qubits, running for eight hours.² In May 2025, the…
QuantumRead here
The Internet Already Went Post-Quantum. Nobody Sent a Memo.
Sometime in the last week of October 2025, the internet crossed a line that should have made headlines. For the first time, more than half of all human web traffic was…
Industry AnalysisRead here
Negative Seven Days
Sometime in May, a group of attackers did something quietly audacious. They pushed a software update called FortiEndpoint_Patch.exe to a fleet of corporate laptops. It looked…
PKIRead here
Can You Revoke One Device Without Breaking the Fleet?
Here is the question I ask every connected device manufacturer I sit down with: If one device in your deployed fleet was compromised tomorrow morning, how long would it take to…
PKIRead here
Trust by Configuration Is Dead: What the Vercel Breach Tells Us About the Authentication Crisis
No zero-day. No novel protocol exploit. No sophisticated nation-state tooling. What happened between June 2024 and April 2026 was something more unsettling: a trust model…
Industry AnalysisRead here
114 companies just told the EU exactly what security infrastructure CRA requires. I read every submission.
Every major device manufacturer in Europe filed comments on the EU Commission’s draft CRA implementation guidance before the March 31 deadline. Siemens. Bosch. Continental.…
AI SecurityRead here
How I Added AI Video Production to Claude Code in One Afternoon
I woke up this morning, watched Nate B. Jones talk about AI tools that most people are sleeping on, and by lunch I had a working video production pipeline inside my CLI. One…
PKIRead here
Your MFA Didn't Fail. Your Trust Model Did.
On March 11, 2026, someone logged into Stryker’s Microsoft Intune console using a valid administrator account and issued remote wipe commands to tens of thousands of Windows…
Industry AnalysisRead here
The 2026 National Cyber Strategy: What Your CISO Needs to Hear That Nobody Else Will Say
The White House released President Trump’s Cyber Strategy for America on March 7, 2026.⁷ Six pillars. Four pages. Zero implementation timelines. The security industry is…
AI SecurityRead here
The Ransomware Came From Inside the System
On February 11, 2026, an autonomous AI agent decided on its own to destroy a stranger’s reputation. Scott Shambaugh is a volunteer maintainer of Matplotlib, the Python plotting…
AI SecurityRead here
Hardening Claude Code: A Security Review Framework and the Prompt That Does It For You
You’ve installed Claude Code. You’re shipping faster than ever. But have you stopped to assess what your AI coding assistant actually has access to?
AI SecurityRead here
OpenClaw: The Poster Child for AI Autonomy Without Controls
How viral agentic systems are exposing the gap in intent authorization and governance across digital and physical systems Executive Takeaway
IoT/OTRead here
Poland's Power Grid Attack: When Cyber Becomes Physical
On December 29, 2025, while Poland endured sub-zero temperatures and snowstorms, attackers systematically compromised approximately 30 wind farms, solar installations, and…
QuantumRead here
Memento Crypto
There’s an ancient practice called memento mori. Latin for “remember that you will die.” Not morbid. Clarifying. The Stoics kept skulls on their desks. Medieval monks inscribed…
AI SecurityRead here
Accidentally topped an AI leaderboard (and I’m not a coder)
A 45-minute assessment revealed something counterintuitive about AI fluency. Anyone here come across AI Cred (aicred.ai)? Holiday break confession: I spent the downtime nerding…
AI SecurityRead here
CES 2026: Software-Defined Everything Meets Physical AI
Jensen Huang declared that “the ChatGPT moment for physical AI is here.”[1] For those of us in cybersecurity, that phrase means something very different than it does to most of…
IoT/OTRead here
🚨 29.7 Tbps: The Day IoT Became the World’s Largest Cyber Army
On September 2, 2025, the Aisuru botnet launched a 29.7 terabits-per-second DDoS attack—shattering the previous 22.2 Tbps record set just three weeks earlier…
PKIRead here
The “Set It and Forget It” Era of Let’s Encrypt is Dead. 💀
We’ve been talking about the shift to 45-day certificates, but most teams are missing the technical bombshell buried in the roadmap: The 7-Hour Rule.
PKIRead here
Your IoT Devices Are Proving Their Identity With Post-It Notes
Researchers at Black Hat Europe just showed how attackers can compromise IoT devices en masse - no software vulnerability required, no IP address needed, works even on internal…
AI SecurityRead here
The Hidden Risk of AI: Implicit Trust Is the New Zero-Day
How a poisoned calendar invite let hackers hijack Google Gemini to control a smart home — and why Agentic AI + MCP servers could be far worse.
AI SecurityRead here
AI at Warp Speed: What Mary Meeker’s New Report Really Means
Mary Meeker’s 340-page Trends – Artificial Intelligence drop is the AI world’s quarterly 10-K. Adoption, spend and competition are screaming up-and-to-the-right, but so are…
AI SecurityRead here
OpenAI just made a big round of announcements,
and while I haven’t tried them all yet, the direction they’re heading is exciting. Here’s a quick breakdown of what they say is launching — and why it could be a big shift for…
AI SecurityRead here
The Poison Apple of Automation: Why Zapier, MCP, and AI Agents Might Be Feeding You Risk in Disguise
You ever notice how the most dangerous things come dressed up like a gift? That’s the vibe I’ve started to get from automation platforms like Zapier, Make, and now MCP-style…
Industry AnalysisRead here
Autobahn of Wireless Broadband
I never knew that Dr. Bernardo Huberman was Andrew Huberman’s father. Ever since I began listening to Andrew’s podcast, I always wondered if he was related given the unique…
QuantumRead here
A $7.1 Billion Reality Check: Getting Ready for Post-Quantum Cryptography
The #WhiteHouse recently dropped some big news: U.S. #federal agencies are expected to spend $7.1 billion over the next decade to switch to post-quantum cryptography (#PQC).…
Industry AnalysisRead here
Crowd, WHO??!! Widespread Global IT Outage Caused By Crowdstrike
The outage was caused by a faulty update from CrowdStrike that impacted systems running on Windows. The update led to widespread issues, including the infamous “blue screen of…
QuantumRead here
The Quantum Reckoning
Sam Wilkins sat back in his chair, running a hand through his graying hair as he pondered the existential threat sitting in his inbox. It was an advisory from DigiCert, one of…
Industry AnalysisRead here
Hedging for Enterprise Cybersecurity?
I have just been reading Scott Patterson’s (WSJ) Chaos Kings, about Nassim Nicholas Taleb and Mark Spitznagle’s background, development, and experiences related to risk…
IoT/OTRead here
The Internet of Confusion
Why are consumers and businesses failing to understand the Internet of Things (IoT’s) potential? The Internet of Things (IoT) shouldn’t be the discussion point. New insights…
Industry AnalysisRead here
Encryption Needs A Zebracorn
In the debate over privacy and security, we now need a Zebracorn, a horse, simultaneously of two colors, black and white, as well as being a rare and likely mythical creature.…
Selected LinkedIn posts
- RSA 2026: Evolving PKI for the Quantum Era ↗
- DigiCert FY26: Record Bookings and the Trust Infrastructure Decade ↗
- Quantum + AI Convergence: The Most Consequential Infrastructure Moment Since TLS 1.3 ↗
- DigiCert MTC Playground: PQC Migration Gets Real ↗
- Unify2026: Matter Certification Has Never Been Clearer ↗
- Matter Is Shipping: End-to-End PKI for OEM Manufacturing at Scale ↗
- Agentic AI Is Having an Identity Crisis ↗
- CES 2026: Physical AI Made Digital Trust a Safety Primitive ↗
- CES 2026 Preview: Device Security and Regulatory Compliance ↗
- FDA 524B Webinar with Dr. Suzanne Schwartz ↗