Deployed it. Sold it. Now I answer for it.
Most writing about security and AI comes from one seat. I have sat in three — delivery, then sales, now customer experience — and the view changes more than you would expect between them.
This is a field guide, not a feed. What actually happens when this technology meets a real environment: the practices that hold, the mistakes that repeat, and the ones I made myself.
| channel | n | latest |
|---|---|---|
| field-note | 01 | 2026-03-11 |
| pattern | 00 | —— |
| postmortem | 00 | —— |
| signal | 01 | 2026-09-08 |
2 published · 2 in draft · feed at /rss.xml
newest › Agent 365 and the posture gap
built 2026-09-10 · static · no trackers
The guide
-
Field notes 01
A situation from a real deployment — what happened, what it cost, and what I would do differently. Details are composited across engagements.
-
Patterns 00
The practice that falls out of seeing the same thing go wrong repeatedly. Written to be handed to a team, not admired.
-
Postmortems 00
Things that went wrong. Mine first, and customers second — with the part I got wrong left in.
-
Signals 01
What is arriving next, and which assumption it quietly breaks. Less prediction, more consequence.
Most recent
Agent 365 and the posture gap
Agent inventory tells you which agents exist. It doesn't tell you which ones can quietly reach your crown jewels.
The State of Zava: a fictional state, a real problem, a working prototype
A state CISO is accountable for hundreds of organizations they can't give orders to. I built a dashboard to find out what that actually takes.
Get new writing by email
Field notes, patterns, postmortems, and signals on security and AI. One email when something new goes up, and nothing else.
No tracking pixels. Unsubscribe from any email.