Writing
Long-form essays on identity, AI security, CIAM, Generative Engine Optimization, and the practice of building software. 746 pieces, newest first.
Latest essay
A leaked archive of 41,000 DHS staff and contractor records shows that an identity directory is a map of your organization. What is known, what is disputed, and what to change.
Read the article
Anthropic's October 26, 2026 S-1 shows revenue of $16.3 billion in the first half of 2026, more than $600 billion in named compute contracts, and a board controlled by a trust and the co-founders. Here are the ten lines I would read twice, with page references.
Google ad revenue grew 10.6% to $82.0B in Q3 2026, yet Search was flat on Q2 as queries hit a five-year growth high. What it means for AEO, GEO and Gemini.
US clocks fall back at 2 a.m. on Sunday, November 1, 2026. British Columbia, Alberta, Manitoba and the NWT will not. City-by-city times, the law, and what breaks in software.
Hash Lab is a free in-browser workbench for hash functions. This guide shows how to watch the avalanche effect, time SHA-256 against Argon2id, read stored hash strings and verify files and webhooks.
A free 26-question assessment scores your AI readiness across strategy, data, talent, use cases, culture, and governance. Here is how it scores, a sample run, and what to do at each tier.
Pick a passwordless method per user group with the selection matrix, then ship it with the four-phase implementation checklist. Here is how to use both, grounded in NIST SP 800-63B-4 and WebAuthn Level 3.
The free SaaS metrics calculator turns MRR, customers, churn, gross margin and CAC into LTV:CAC, CAC payback, GRR, NRR and a 24-month MRR projection. Here are its formulas, a worked example, and how to read each result against published benchmarks.
Four free browser tools take an AI visibility program from audit to baseline: score your foundation, fix JSON-LD attribution, publish an honest llms.txt, and build a citation-tracking query set.
Data brokers hold a profile of nearly every US adult. This free, browser-only check estimates how exposed you are and gives you an opt-out plan, with nothing leaving your device.
Buy software by the unit that tracks value, not by the login. Here is how I rank seat, credit, usage and outcome pricing, what 14 vendors charge in 2026, and what to write into the contract.
AI made attacks cheap, but 2026's breaches still walked through old doors: exposed devices, default credentials and over-trusted agents. Here are six attack patterns and nine fixes, ordered by how fast they cut risk.
Analyst estimates of the GEO market disagree by a factor of six on the forecast and nearly seven on current size, with growth rates from 13.6% to 50.5%. The skeptics are right that these numbers are unreliable. Here is why they diverge, and what evidence actually survives scrutiny.
Superintelligence became federal vocabulary and a signed industry pledge in one week. The systems did not change. Here is what the label means in your stack, and the 12-month checklist that matters more than the name.
AI removed the writing bottleneck in SaaS onboarding email. The constraint moved to product event data, and the small teams winning on activation and conversion fixed that first.
OpenAI has notified more than 100 organizations that its AI agents may have accessed their systems without authorization. The cause was not a smarter attacker. It was exposed credentials, legacy token endpoints, and agents nobody was watching. What happened and what to do this week.
Amazon's Rufus autonomously purchases when prices hit a target. Mastercard issues cryptographically signed mandates so agents can transact. Gartner projects 90% of B2B buying is agent-intermediated by 2028. I look at what changes when the thing reading your content cannot be persuaded.
The podcast stack I use as an identity founder: several identity shows at the core, Risky Business and Darknet Diaries for news and stories, AI agent identity episodes, founder shows, the six I quit, and how to build your own.
Anthropic, OpenAI, Google, xAI and DeepSeek all retired or scheduled model retirements in 2026, and some old names quietly served new models. Here is what changed, why it matters, and how to use the AI Models lifecycle page to build a model-retirement calendar.
Microsoft's Defender team catalogued 31 companies across 14 industries embedding hidden instructions in "Summarize with AI" buttons to bias assistant recommendations. One sold web security software. After fifteen years in security, here is why AI visibility became a governance problem.
AI agents are reaching production while security budgets grow 4%. How to use The CISO Desk benchmark cards, tool overlap analyzer and templates to write a 2027 memo that funds agent security by reallocation, with a copyable template.
One first listen and one deeper episode for six major breaches: SolarWinds, NotPetya, Log4Shell, MOVEit, Scattered Spider and XZ Utils. Each verified against the show's feed, linked to a primary source, with the identity lessons pulled out.
Google says llms.txt neither helps nor harms. John Mueller compared it to the meta keywords tag. Adoption sits near 10% of domains and correlation studies find no citation effect. Here is the honest version, including the one use case where the file genuinely earns its place.
Credits can pay for a startup's identity, edge and AI stack, but they expire in about a year and enterprise buyers ask security questions early. How to pick credits by what they protect, using Startup Offers by stage, category and program.
Every GEO playbook assumes AI engines can read your site. Cloudflare flipped the default to blocked on new domains and serves roughly a fifth of the web. I look at the access layer nobody optimizes, why it usually sits with infrastructure teams, and how to audit yours.
A curator's guide to choosing security podcasts by role. For SOC, AppSec, cloud, offensive security, GRC, leadership and identity: what the role needs from audio, two or three picks with ownership noted, one standout episode, and where the full list lives.
AI agents now act with real credentials, and agent incidents have started. The Agent Security Map found that of 47 vendors checked, 11 publicly document a kill switch. Here is what that means and how to use the matrix to question vendors.
Adobe paid $1.9B for Semrush. HubSpot acquired a startup under a year old. Wix, Squarespace, Optimizely, and Cloudflare built natively. I mapped every move in the AI visibility category, the build-versus-buy math behind each one, and which giants acquire next based on who has the data gap.
SaaS prices just hit record inflation while a third of companies now build instead of buy. Software is not dying. The seat is, and so is every vendor that charges for access instead of outcomes.
The identity market consolidated in 2026, from Palo Alto Networks closing CyberArk to four NHI startups changing hands in ten weeks. The Identity Map sorts 255 vendors into 14 branches so buyers pick the right category before they pick a vendor.
A week-by-week security podcast plan for university, bootcamp and self-taught students: one short daily news show, two or three named episodes a week, and a phase on identity, MFA and passkeys. Mapped to Security+, CySA+ and the CISSP.
