Writing
Research and field notes
Deep dives, threat analysis, and notes from the work - mostly on AI and agent security, sometimes on whatever is breaking this week.
Latest
How to Evaluate Tools for Securing Production AI Agents
Give a vendor a support workflow and inspect what reaches the resource APIs. Test changed approvals, alternate paths, retries, and outages.
September 9, 20264 min readAI Security
Read article
July 2, 20214 min read
TOGAF And Zachman For Security Architecture
Use contractor access expiry to work through the difference between planning an architecture change and finding gaps in its description.
TOGAFZachman FrameworkEnterprise Architecture
June 15, 20214 min read
Using C4 Diagrams In Security Work
Follow a customer attachment from the browser to storage, using C4 to locate the ownership check and the paths that might bypass it.
C4 ModelArchitecture DiagramsCybersecurity
May 20, 20214 min read
4+1 Architecture Views For Security Reviews
A refund times out and two workers may retry it. Follow the same operation through the logical, code, runtime, and deployment views.
4+1 ArchitectureKruchtenSystem Architecture