CISO and CTO with nearly three decades in technology and security leadership. I write about AI adoption, cybersecurity economics, and the structural forces that make fragile systems rational. Independent researcher and literary nonfiction writer.
AI & Technology
A ten-part series examining how AI actually behaves once it's embedded in real work. Each principle begins with a failure mode, traces it to its structural cause, and proposes a way to stay oriented as scale, speed, and confidence outpace judgment.
Essays
Proof is often treated as an endpoint, the thing that resolves uncertainty and compels agreement. In complex systems, it rarely works that way. What happens between the evidence and the person interpreting it matters more than the evidence itself.
Blueprints
A blueprint for understanding systemic digital vulnerability. National cyber risk is not a collection of isolated security incidents. It is macroeconomic exposure, and markets and states consistently underprice it.
Essays
Fragile systems rarely announce themselves. They continue to operate, deliver value, and meet surface-level expectations long after their internal coherence has begun to erode. The costs accumulate where nobody is looking.
Essays
Modern digital systems treat visibility as a default and anonymity as something to be explained or eliminated. But the economic and ethical costs of exposure run deeper than most system architects acknowledge, and the trade-offs are rarely made explicit.
The path into the technology industry has changed in ways that most career advice hasn't caught up with. The onramp is narrower, the expectations higher, and the old assumption that beginners would be given time to grow has largely disappeared.
Essays
When instability becomes visible and failure appears imminent, the impulse to act feels necessary. But intervention in complex systems is never neutral. Every action reshapes incentives, redistributes risk, and alters the conditions it was meant to repair.
Essays
Digital systems were designed around stable identities: users authenticate, services execute predefined roles, boundaries hold. Under sustained pressure, that assumption erodes. Identity becomes fluid, strategic, and contingent in ways that most security models don't account for.
Essays
If cost asymmetry is the enabling condition of intrusion, the goal of security design changes. The question is no longer how to block every attack but how to alter incentives so that rational attackers disengage. Part three of a three-part series.
Essays
If intrusion is an economic activity, then cost is the variable that matters most. When marginal costs for attackers and defenders are compared, the imbalance becomes impossible to ignore. Part two of a three-part series.
Essays
Intrusion is usually described as a failure of controls or competence. But if well-designed systems still get breached, something other than technical deficiency is at work. This is the first part of a three-part series reframing security through economic analysis.
An envelope arrives just before Christmas, correctly addressed, incorrectly named. For a short time, it remains where it does not belong, asking nothing, changing something.