Why I Created This Publication

Conversations that get to bare metal — where ideas meet infrastructure.

I built this publication because the cybersecurity conversation has drifted into noise. Too much of what gets published today is reactive, sensational, or optimized for engagement rather than clarity. The result is a landscape where meaningful analysis is buried under provocative commentary, recycled talking points, and vendor‑driven narratives.

I wanted a space that does the opposite.

A place for long‑form thinking

Cybersecurity is fundamentally about incentives — economic, political, technical, and human, and how those incentives shape behavior across attackers, enterprises, and autonomous systems. But most platforms reward short‑form commentary, which flattens nuance and obscures the structural forces that actually shape attacker behavior and defensive strategy. This platform gives me a clean, distraction‑free environment to write the kind of analysis that doesn’t fit into a LinkedIn post.

A platform I control

I didn’t want an algorithm deciding who sees my work or how it’s framed. I wanted a publication where:

The writing stands on its own merit
The archive is organized intentionally
Readers can explore ideas without ads, pop‑ups, or engagement traps
The design reflects the seriousness of the subject matter

This platform gives me that control. It’s fast, minimal, and built for writers who care about ownership and longevity.

A home for the “Incentive Gradient” framework

Over the last few years, I’ve been refining a way of explaining cybersecurity that focuses on attacker incentives, defender constraints, and the economic forces that shape both. This publication is where that framework will live — not as a marketing slogan, but as a lens for understanding how the field is evolving.

My goal is to publish work that:

Cuts through hype
Clarifies complex dynamics
Helps leaders make better decisions
Connects technical realities to governance and strategy

A commitment to depth over volume

This won’t be a high‑frequency blog. It will be a place for essays that matter — pieces that take time, that synthesize research, that challenge assumptions, and that offer something useful to practitioners, executives, and policymakers.

If you’re here, it’s because you’re looking for substance. My commitment is to deliver exactly that.

Why Securing AI Systems Is Not the Same as Securing Traditional Web Applications

Executive Summary Traditional web security assumes that valid input can be defined and enforced. AI systems break that assumption. They accept unbounded, multimodal input such as text, code, images, audio, and more, and interpret meaning rather than structure. This shift makes deterministic validation impossible and forces a new security model.

Ninety Days After Mythos: What the Data Now Shows About Vulnerability Management in the AI Era

When Anthropic announced Project Glasswing on April 7, 2026, the headline was impossible to ignore: Mythos, an AI system capable of semi‑autonomous vulnerability discovery and exploitation at machine speed, uncovered thousands of high‑severity flaws across major platforms during its pilot phase. The industry understood immediately that Mythos wasn’

If Malware Were a Country…

Many across the industry are rightly focused on the surge in vulnerability disclosures unlocked by new AI capabilities. But another milestone is approaching — one that is just as consequential. AI hasn’t only accelerated vulnerability discovery; it has industrialized the malware that exploits those vulnerabilities. If malware were a country,

Government Access to Data: Policy Panic vs. Operational Reality

I worked in Europe during one of the most consequential periods for global cybersecurity policy — the early enforcement of GDPR and the passage of the CLOUD Act. As Amazon Web Services’ Cybersecurity and Compliance Leader for Europe, the Middle East, and Africa, I sat at the center of a shift