
ServiceNow's requires_authentication=false: The One Boolean That Exposed Enterprise Data Worldwide
ServiceNow shipped a REST endpoint with authentication disabled. Attackers queried customer data without credentials. The company knew since April.
Writing
Page 2 of 22.

ServiceNow shipped a REST endpoint with authentication disabled. Attackers queried customer data without credentials. The company knew since April.

The structured data that gets cybersecurity vendors cited by AI: five JSON-LD schema types, plus how to reference CVEs, MITRE ATT&CK techniques, and NIST controls as extractable entities.

Scaling a CIAM platform past a billion users taught me that customer identity is a trust problem: progressive profiling, risk-based auth, and passwordless done right.

Traditional vulnerability cycles take months from discovery to patch. AI compresses that to hours. CrowdStrike reports 29-minute breakout times and 89% more AI-augmented attacks year-over-year.

MCP concentrates every AI-agent-to-tool interaction through one interface, and that makes it a new attack surface. A breakdown of the vulnerabilities and how to secure them.

Marketing says GEO is theirs. Comms says it belongs to them. SEO assumes it's the next chapter of their job. They're all partly right, and the fight itself is the symptom of a deeper confusion: GEO spans layers no single team owns. Here is a model that resolves it.

Security leaders face over 10,000 alerts a day. Here is how to build a personalized cybersecurity news feed that filters the noise and surfaces the threats that matter to your organization.

Okta and Microsoft no longer define the CIAM market alone. Five developer-first, passwordless-native, and AI-ready platforms are growing fast by solving the specific problems the incumbents leave unaddressed. Here is where each one fits in 2026.

For decades, Gartner and Forrester shaped enterprise buying. Now buyers ask ChatGPT and Perplexity before they ever open a Magic Quadrant. Here is how analyst influence is actually shifting, and what it means for how companies build credibility.

America turns 250, and it is still the best place to build something the market has no words for yet. A founder's reflection on a career spent doing exactly that.

Every few months another tech giant is fined hundreds of millions for violating your privacy. The numbers are enormous, the violations keep accelerating, and the math explains why: the penalties cost far less than compliance. Here is what they really mean, and what you can actually do.

When a buyer asks an AI engine whether your product supports something, the answer often gets grounded in your documentation, not your marketing. Most companies treat docs as a cost center. In the AI search era, your documentation is one of the highest-value visibility assets you own.

PBKDF2 is not deprecated, but it is no longer the recommended default for new systems. Here is the honest, practical answer for developers: when PBKDF2 is still acceptable, when you should reach for Argon2id instead, and how to decide for your system.

Finding out your password was in a data leak is unsettling, but panic is not the right response and neither is ignoring it. Here is exactly what to do, in priority order, and an honest answer to how worried you should actually be.

Which is the No. 1 secure browser?" is the wrong question. Security depends on your threat model, not a leaderboard. Here is an honest comparison of Chrome, Firefox, Brave, and Safari in 2026, and how to actually choose.

When you name a feature something clever that no buyer would ever type into ChatGPT, you make your product harder to surface for the exact question it answers. Feature naming has always been positioning. Now it is discoverability, and product managers own it.

Before the Bay Area, before GrackerAI, there was Canada. My first company started there, the one that grew to manage identities for over a billion users. A Canada Day reflection on where a founder story began and why a smaller stage is a gift.

Traditional impressions on our properties fell 10-20% this year. AI search visibility rose 35%. That inversion is not a problem to fix; it is the new shape of B2B discovery, and the AI channel brings better-qualified buyers. Here is the data and what it means.

Eleven sub-portals plus the apex blog. Here is how they interlink for AI search, what each surface owns, the editorial architecture, and the practical stack I run them on.

Business books optimise for shareable takeaways. Biographies preserve the messy situations the takeaways came from. Here is why the latter teaches more, and the 14 biographies I recommend instead.

You can check whether ChatGPT, Perplexity, Gemini, and Google AI Overviews mention your brand for free, in your browser, in about a minute. Here are the free AEO/GEO visibility checkers and Chrome extensions worth using in 2026, what each measures, and how to turn a score into a plan.

SEO became a craft because you could reverse-engineer one ranking function. GEO can't work that way: you're optimizing against many non-deterministic models with probabilistic citation behavior. That makes GEO experimental science, and it should be run like a product team runs experiments.

When I founded LoginRadius in 2013, there was no cybersecurity-founder playbook. I wrote 11 e-books to be what I wish I had. Here's each one and the lesson it captures.

Crawl budget is no longer a technical SEO footnote. Google's AI surfaces draw from the same Search index as the blue links, so whether you appear in an AI answer reduces to whether Google crawled, indexed, and kept your pages fresh.

I audited 200+ tech predictions over 10 years. 87% failed for one of four reasons. Here are the four failure modes with named examples, and how to spot them in any prediction you're tempted to make.

Apple Podcasts and Spotify recommend the same 10 shows to everyone. The "best tech podcasts" lists are SEO chaff. Here is why discovery broke and the editorial-curation alternative.

The entire GEO industry treats AI visibility as a marketing problem: track citations, optimize content, report share of voice. That framing is why most GEO programs plateau. The deeper truth is that GEO is a product discipline, and the teams winning at it have figured that out.

MQL-driven gated content is still the B2B SaaS orthodoxy. I un-gated every e-book in 2025. Here are the actual numbers on pipeline, AI citation share, and brand authority 12 months later.

Founders rebuild MongoDB-as-default, Google Reader, Microsoft Bob without knowing why each one failed. Seven recurring failure patterns, with named examples and how to spot them in your stack.

The leading non-human identity (NHI) management tools for 2026, compared by job: discovery and posture, secrets management, machine identity, and workload identity.