Field guide
Organized by what you came for, not by when I wrote it. Four sections: a situation, a practice, a failure, or something arriving next.
Field notes
A situation from a real deployment — what happened, what it cost, and what I would do differently. Details are composited across engagements.
The State of Zava: a fictional state, a real problem, a working prototype
A state CISO is accountable for hundreds of organizations they can't give orders to. I built a dashboard to find out what that actually takes.
Patterns
The practice that falls out of seeing the same thing go wrong repeatedly. Written to be handed to a team, not admired.
Nothing here yet.
Postmortems
Things that went wrong. Mine first, and customers second — with the part I got wrong left in.
Nothing here yet.
Signals
What is arriving next, and which assumption it quietly breaks. Less prediction, more consequence.
Agent 365 and the posture gap
Agent inventory tells you which agents exist. It doesn't tell you which ones can quietly reach your crown jewels.
Get new writing by email
Field notes, patterns, postmortems, and signals on security and AI. One email when something new goes up, and nothing else.
No tracking pixels. Unsubscribe from any email.