// BLOG
All posts.
Field notes from 20+ years in security. Plus the occasional detour into life, work, and whatever else is on my mind.
How to Pick an MDR Provider When You're a Community Bank
Every MDR vendor says they do detection and response. Here's what to actually evaluate before you sign a contract, and the questions most community banks never think to ask.
The FFIEC CAT Is Gone. Now What?
The FFIEC retired the Cybersecurity Assessment Tool. Here's what community banks actually need to do now, what examiners are looking for instead, and how to transition without starting from scratch.
The Framework Trap: When Compliance Kills Security
Security frameworks were built to guide programs, not replace thinking. Do security right and compliance follows. Here's why most organizations have it backwards.
I Spent Eight Hours on My Home Network. I'm Still Not Done.
A home network rebuild that's still in progress and already has lessons. Documentation debt is real, and it costs you more than a weekend.
Your Vendors Are Your Biggest Security Risk. Here's What to Do About It.
Most community banks can answer every question about their own security posture. But ask about their vendors, and you get silence. Here's how to fix that.
The Real AI Threat Isn't Job Loss. It's Irrelevance.
Everyone's worried AI will take their job. The bigger risk is becoming the person who can't keep up because you refused to learn how to use it.
It's 2026. You Can Use the Guest WiFi.
A security professional scolded me for connecting to guest WiFi. Meanwhile, 100+ CISOs signed a letter asking people to stop giving exactly that advice.
You Want to Try OpenClaw. Here's How to Not Wreck Yourself.
OpenClaw is genuinely cool technology—and a real security risk. Instead of telling you to run away, here's how to experiment with it safely.
Why Your Incident Response Plan Will Fail (And What to Build Instead)
Most IR plans fail not because they're poorly written, but because plans don't survive contact with reality. Here's how to build response capability instead of just documentation.
The Drinking Bird at the Nuclear Plant
Sam Altman wants to give AI full access to everything. Your users will too. Your AI security strategy isn't competing against attackers; it's competing against tedium. Tedium wins.