Field notes from the CISO chair.
Practical writing on AI security, AppSec for engineering teams, and the threat landscape your auditor hasn't caught up to yet.
Agentic Identity Management — Mid-2026 Vendor Landscape
AI agents broke the old human-vs-machine identity model. This field guide maps the vendors, standards, gaps, and buying scenarios shaping agentic identity management in 2026.
Read articleMore writing
5 articlesWhy AI Security Training Can't Wait Until After the Breach
We're in a gap between AI adoption speed and security training. Here's why that gap is the most expensive risk on your balance sheet.
SDLC Security Training Developers Will Actually Use
Completion rates are high, but developers are still shipping the same vulnerabilities. The problem isn't the developers — it's the training.
Your AI Coding Assistant Has OWASP Blind Spots. Here's What to Train For.
AI coding assistants are remarkable productivity tools. They're also, in specific and predictable ways, security liabilities.
Five API Security Mistakes Almost Every Engineering Team Makes
Your API is your attack surface. These five patterns show up in almost every codebase we audit — and most teams don't catch them until production.
Your Package Manager Is an Attack Vector. Are Your Developers Ready?
Supply chain attacks through package managers have gone from theoretical to routine. Most developer teams still install dependencies without a second thought.