Writing
Long-form essays on identity, AI security, CIAM, Generative Engine Optimization, and the practice of building software. 728 pieces, newest first.
Latest essay
AI agents are reaching production while security budgets grow 4%. How to use The CISO Desk benchmark cards, tool overlap analyzer and templates to write a 2027 memo that funds agent security by reallocation, with a copyable template.
Read the article
One first listen and one deeper episode for six major breaches: SolarWinds, NotPetya, Log4Shell, MOVEit, Scattered Spider and XZ Utils. Each verified against the show's feed, linked to a primary source, with the identity lessons pulled out.
Google says llms.txt neither helps nor harms. John Mueller compared it to the meta keywords tag. Adoption sits near 10% of domains and correlation studies find no citation effect. Here is the honest version, including the one use case where the file genuinely earns its place.
Credits can pay for a startup's identity, edge and AI stack, but they expire in about a year and enterprise buyers ask security questions early. How to pick credits by what they protect, using Startup Offers by stage, category and program.
Every GEO playbook assumes AI engines can read your site. Cloudflare flipped the default to blocked on new domains and serves roughly a fifth of the web. I look at the access layer nobody optimizes, why it usually sits with infrastructure teams, and how to audit yours.
A curator's guide to choosing security podcasts by role. For SOC, AppSec, cloud, offensive security, GRC, leadership and identity: what the role needs from audio, two or three picks with ownership noted, one standout episode, and where the full list lives.
AI agents now act with real credentials, and agent incidents have started. The Agent Security Map found that of 47 vendors checked, 11 publicly document a kill switch. Here is what that means and how to use the matrix to question vendors.
Adobe paid $1.9B for Semrush. HubSpot acquired a startup under a year old. Wix, Squarespace, Optimizely, and Cloudflare built natively. I mapped every move in the AI visibility category, the build-versus-buy math behind each one, and which giants acquire next based on who has the data gap.
SaaS prices just hit record inflation while a third of companies now build instead of buy. Software is not dying. The seat is, and so is every vendor that charges for access instead of outcomes.
The identity market consolidated in 2026, from Palo Alto Networks closing CyberArk to four NHI startups changing hands in ten weeks. The Identity Map sorts 255 vendors into 14 branches so buyers pick the right category before they pick a vendor.
A week-by-week security podcast plan for university, bootcamp and self-taught students: one short daily news show, two or three named episodes a week, and a phase on identity, MFA and passkeys. Mapped to Security+, CySA+ and the CISSP.
Scattered Spider never broke MFA. It phoned the help desk and had MFA moved. What MGM, Caesars, TfL and M&S disclosed, what the Scam Atlas sourced cases show, and a short reset checklist for IT teams.
On September 20, Amazon blocked Meta's new Muse AI agent from its store. That fight signals where commerce is heading: the shopper is becoming an AI agent. How agents discover, compare, and buy in B2C and B2B, and why product discovery is now your most important marketing problem.
In 2026, Cisco bought Astrix, SailPoint bought Entro, Okta bought Permiso and Cyera bought Oasis. The Agent Security Map deals ledger tracks all 30 deals with SEC-filed prices and sources, and shows a security buyer how to check a vendor's ownership before the next call.
Americans reported $20.9 billion in scam losses to the FBI in 2025, and phishing was only about 1% of it. Investment and trust scams took the most, especially from older relatives. Here is what the numbers mean for your family, and how to use the Scam Atlas to spot and report a scam.
America.gov launched on September 29, 2026 as a single AI front door to federal services, drawing on 29,000 government websites. What it does today, how to use it well, where it falls short, and what other countries should take from it.
Jensen Huang declared AGI had arrived in a post that ended with "400K GPUs coming online next." That is not a scientific claim. It is a capital request with a headline attached. 2026 was remarkable. It was not the year general intelligence arrived.
Your account is only as secure as its weakest reachable path, and that path is usually recovery. A ranked guide to recovery methods, the NIST-backed design rules, and the help desk vector behind MGM, TfL and M&S.
The 2026 Big Tech enforcement record in one place: four penalties worth about $14.1B, led by US states rather than Brussels, and dominated by children's safety. Here is what the Tech Fines tracker shows and how to follow it.
Picking an age verification vendor is the last decision, not the first. The duty you are actually under, the methods ladder, the one-bit record, and where the age claim lives in your identity model.
Chrome shipped DBSC to stable. It binds the session cookie to a key in the TPM, which makes a stolen cookie inert off the originating device. Here is the protocol, the honest limits, and the buyer checklist.
Vendor log retention ends months before the average breach is discovered. The funnel, security, and silent-failure metrics every CIAM deployment should have, and the seven-panel dashboard to start with.
Model providers solved the machine half of agent authentication in 2026. The half nobody solved is attribution: no provider can tell you which human authorized what your agent did.
Referral and inbound carry the lowest CAC because the buyer arrives already educated. But the cheapest channel is not automatically the right one: deal size and whether demand already exists decide which channels can work at all.
Zero data retention is not a setting, it is a contract term with a scope. The gap between what founders think ZDR covers and what it contractually covers is wide enough to fail an enterprise review.
ISO 42001 went from obscure standard to procurement line item in about eighteen months. It does not certify that your model is safe, and the certificate scope is where buyers consistently misread it.
Security practitioners are professionally trained to distrust claims, which makes them the hardest audience in B2B for conventional content marketing. The way through is not better persuasion. It is content specific enough to be checked.
Most founders think the EU AI Act is the model provider's problem. If your output is used in the EU, you carry obligations of your own, and the enforcement machinery went live in August 2026.
More than half of BIMI records are broken and nobody got an error. Silent failure is a whole category of security control, and most of yours are in it.
Most teams treat LLM output as deterministic. We measured 180,000 responses across four AI engines for 18 months and found the opposite: visibility drops 30% overnight, and the engines agree on 11%.
The handoff was never a document problem. What AI actually changes about moving a customer from sales to support, and why the same work makes AI engines understand your product.
