Featured perspective · Leadership
AI isn't a strategy.
AI can expand what a business is capable of. Strategy decides which capabilities are worth using, why they matter, and where they should take us.
Read the perspective ↗ Security / Technology / Leadership
Cybersecurity, curiosity, and the occasional side project.
I’m Jesse. I lead security teams for a living, build games for fun, and have a habit of taking things apart to understand how they work. This is where I write about what I’m learning, what I disagree with, and whatever else has me curious.
Explore my thinkingA CLOSER LOOK
IDENTITY AT THE CENTREHUMAN + MACHINE
Business judgmentTechnical depthLeading teamsBuilding what’s next
THE NOTEBOOK
Things I’ve been thinking about.
AI isn't a strategy.
AI can expand what a business is capable of. Strategy decides which capabilities are worth using, why they matter, and where they should take us.
Giving AI the ability to act changes the risk
AI can identify a real security problem and still recommend the wrong business decision. How do we turn useful analysis into actions we can depend on?
Support your team. Expect ownership.
A serious mistake tests more than a system. It tests whether people can tell you the truth, whether ownership means anything, and whether your help leaves the team stronger.
Passkeys change what an attacker can steal.
Passkeys remove familiar opportunities to steal and replay credentials. The real security gain depends on how we enroll them, recover access, protect sessions, and retire weaker routes.
Why RBAC is not so simple.
Roles are easy to explain and surprisingly hard to implement. Granular permissions, inherited folder access, and a practical definition of done.
Not all MFA is created equal.
Security questions should be retired. SMS, codes, and push each leave different openings. The useful question is which attack your authentication method can actually stop.
Temporary risks shouldn’t become permanent.
Exceptions can keep a business moving. They become harder to resolve when ownership is unclear, the rating understates the exposure, and renewal replaces a real decision.
Fate Lost’s co-op backend costs $0. Here’s how.
The host’s phone runs the fight. Cloudflare keeps the party together. How I built private co-op, what batching changed, and the compromises I chose to accept.
AI security doesn’t end at launch
The right path to AI adoption combines usable guidance with ownership, bounded permissions, monitoring, and a response that works.
What even is RBAC?
An accessible introduction to role-based access control, why it matters, and how it compares with ABAC and other models.
AI agents need identities, too
AI agents need clear authority, accountable owners, and access designed around the task they are meant to perform.
AI can find weaknesses. Context tells us what matters.
The next step for security is to combine AI-driven testing with what we know about our systems, our clients, and how our businesses actually operate.
Recovery is part of authentication.
A locked-out person still needs help. The recovery process must preserve the trust established at sign-in.
The security gaps between systems
A secure-looking component can still rely on a decision made somewhere else. Follow the trust between systems.
What the security dashboard doesn’t tell you
Leadership needs a clear view of exposure, progress, and the decisions that will help the business move forward.
What is a passkey anyway?
A simple explanation of the digital key behind the sign-in, followed by a closer look at the technology that makes it work.
Threat modelling should change the design
Start with what could go wrong, then make a concrete decision about how the system should work.
A vulnerability backlog is not a risk assessment
Prioritize the exposure that matters, make remediation achievable, and build controls that support dependable delivery.
Stop asking developers to remember everything.
The most useful security improvement may be the one a delivery team no longer has to remember.
When shared ownership becomes nobody’s job
Everyone can be doing their part while a risk stays open. Who has the authority to bring the decision together?
The work doesn’t end with the pentest report
The lasting value of testing is what the organization learns and changes after the report arrives.
Access gets messy when people change roles
Joining, changing roles, and leaving are business events. Access needs to follow them reliably.
No perspectives match. Try another topic or search.
ABOUT JESSE
A little about me.
I’ve always been the person who wants to know how something works. Not just what the diagram says it does, but what happens when something fails, when someone uses it in a way we didn’t expect, or when you look a little closer. I lead teams across enterprise identity, application security, and offensive security. I still like getting into the technical details, and I hope I never lose that.
I’ve learned that being technically right isn’t the same thing as being useful. It’s easy to design a control that looks great on paper. It’s harder to build one that protects what matters without making somebody’s day unnecessarily difficult. That’s the part I care about.
Lately I’ve been spending a lot of time with AI, mostly by trying things and seeing what breaks. Some of it is genuinely remarkable. Some of it is a solution looking for a problem. I’m interested in figuring out which is which.
Before I tell someone how to secure something, I want to know what they’re actually trying to accomplish. There’s usually more than one way to solve a problem. I’d rather have the conversation than arrive with a checklist.
01
What are we trying to accomplish?
Tell me what you need to get done. Launch a service? Give someone access? Put AI to work? I want to understand who depends on it, what it needs to do, and where we have room to make a different choice. A security requirement should have a reason behind it. If I can’t explain how it helps, I owe you a better answer.
02
Show me how it holds up
If we’re counting on a control to protect us, I want to see it tested. Try to get past it. Check the recovery path. Ask what happens when an account is compromised or a dependency fails. I’m quite happy to find out my assumptions were wrong while we still have time to do something about them. Then we need to use what we learned to make the system better.
03
Give people a decision they can make
When I bring you a risk, I should be able to explain what could happen, what we know, and where I’m still making assumptions. You deserve my recommendation, too. What would I do, and why? Once we decide, someone needs to own the next step and have the means to follow through. I want the conversation to leave us able to act.
BEYOND SECURITY
I also make games.
I build games through Wicked Studios. I enjoy taking an idea, getting it to work, and discovering all the things I didn’t think of at the start.