Writing
Research and field notes
Deep dives, threat analysis, and notes from the work - mostly on AI and agent security, sometimes on whatever is breaking this week.
Start here
A few ways into the research, depending on what you’re working on.
AI and agent security
Follow the data, permissions, and evidence behind an agent system.
- How to Evaluate Tools for Securing Production AI Agents
Start with a practical method for evaluating agent security.
- Choosing an AI Agent Memory Service: Security and Performance Tradeoffs
Examine memory, tenant boundaries, and deletion with a local experiment.
- Tamper-Evident AI Agent Logs: Integrity, Gaps, and Limits
Test what an audit trail can prove and where it loses evidence.
Detection and threat research
Turn a detection claim into a repeatable exercise and an analyst question.
- A Repeatable Threat-Hunting Exercise for Small Security Teams
Run an identity hunt against synthetic records and negative cases.
- Evaluating Identity Detection Coverage Across MSP Tenants
Check identity coverage and tenant separation before relying on an alert.
Security architecture
Make system boundaries, assumptions, and design decisions easier to review.
- Using C4 Diagrams In Security Work
Use diagrams to explain trust boundaries and data flows.
- Zero Trust Without The Vendor Fog
Connect Zero Trust principles to implementation decisions.
- 4+1 Architecture Views For Security Reviews
Choose the views that answer a security reviewer’s questions.
Latest
ChatGPT, Claude, and Gemini: Subscription Prices Compared
What the free, $20, and higher-priced AI plans actually include, where usage limits apply, and when the Google bundle or a team plan changes the calculation.
Read article
A Repeatable Threat-Hunting Exercise for Small Security Teams
Run a failed-sign-in and role-grant query against invented events. Eight cases expose its timing rules, tenant boundaries, and missing-event problem.
Choosing an AI Agent Memory Service: Security and Performance Tradeoffs
Start with ownership and deletion, then measure retrieval. A runnable SQLite example tests tenant scope and records local lookup timings.
Evaluating Identity Detection Coverage Across MSP Tenants
Check what each customer tenant is sending, then follow a detection through the central case and back to an authorized response.
How to Evaluate Tools for Securing Production AI Agents
Give a vendor a support workflow and inspect what reaches the resource APIs. Test changed approvals, alternate paths, retries, and outages.
Tamper-Evident AI Agent Logs: Integrity, Gaps, and Limits
A valid log can still be incomplete. A small Python verifier shows what changes when you retain a checkpoint and what a compromised signer can forge.
What AI Agent Assurance Claims Actually Cover
Reading an agent assurance report closely enough to find out which permissions were tested and when the results need revisiting.
InfluenceChat: What Failed While Building A Manipulation Dataset
Keywords and embeddings found the vocabulary of manipulation more often than the intent. The June 2026 results and the plan for synthetic pairs.
AI Safety in Industrial Control Systems
Following a proposed temperature change from historian data to operator review, including stale readings and an unknown command result.
What Destructive Chip Inspection Can Tell You
Opening a suspect chip can reveal the problem and destroy information you still need. The test sequence and comparison sample matter.
Inside The /ghs Label Builder
One canvas renderer feeds the label preview, PNG export, and print image. Notes on saving drafts, fitting text, and reviewing the source information.
December 2025 Site Notes
Moving to Alexandria, clarifying device reviews, and making more room for unfinished research on the site.
Zero Trust Without The Vendor Fog
Follow an employee, contractor, and export job into one reporting application. Then test what grants access and what actually revokes it.
Home Lab Foundations
A single-host Proxmox layout with separate test networks and recovery copies, plus the work that makes rebuilding a guest routine.
TOGAF And Zachman For Security Architecture
Use contractor access expiry to work through the difference between planning an architecture change and finding gaps in its description.
Using C4 Diagrams In Security Work
Follow a customer attachment from the browser to storage, using C4 to locate the ownership check and the paths that might bypass it.
4+1 Architecture Views For Security Reviews
A refund times out and two workers may retry it. Follow the same operation through the logical, code, runtime, and deployment views.