I spend most of my days leading teams and untangling complicated technology problems. I still enjoy getting into the details, and outside of work I build games and experiment with AI. This is where I share the things that catch my attention, along with a few opinions I’m still working through.
Explore my thinking
A memory disclosure bug can make a server share information it never meant to. How does that become remote code execution, and what makes PHP2Shell different?
Read the perspective ↗A memory disclosure bug can make a server share information it never meant to. How does that become remote code execution?
AI can expand what a business is capable of. Strategy decides which capabilities are worth using, why they matter, and where they should take us.
AI can identify a real security problem and still recommend the wrong business decision. How do we turn useful analysis into actions we can depend on?
A serious mistake tests more than a system. It tests whether people can tell you the truth, whether ownership means anything, and whether your help leaves the team stronger.
Passkeys remove familiar opportunities to steal and replay credentials. The real security gain depends on how we enroll them, recover access, protect sessions, and retire weaker routes.
Roles are easy to explain and surprisingly hard to implement. Granular permissions, inherited folder access, and a practical definition of done.
Security questions should be retired. SMS, codes, and push each leave different openings. The useful question is which attack your authentication method can actually stop.
Exceptions can keep a business moving. They become harder to resolve when ownership is unclear, the rating understates the exposure, and renewal replaces a real decision.
The host’s phone runs the fight. Cloudflare keeps the party together. How I built private co-op, what batching changed, and the compromises I chose to accept.
The right path to AI adoption combines usable guidance with ownership, bounded permissions, monitoring, and a response that works.
An accessible introduction to role-based access control, why it matters, and how it compares with ABAC and other models.
AI agents need clear authority, accountable owners, and access designed around the task they are meant to perform.
The next step for security is to combine AI-driven testing with what we know about our systems, our clients, and how our businesses actually operate.
A locked-out person still needs help. The recovery process must preserve the trust established at sign-in.
A secure-looking component can still rely on a decision made somewhere else. Follow the trust between systems.
Leadership needs a clear view of exposure, progress, and the decisions that will help the business move forward.
A simple explanation of the digital key behind the sign-in, followed by a closer look at the technology that makes it work.
Start with what could go wrong, then make a concrete decision about how the system should work.
Prioritize the exposure that matters, make remediation achievable, and build controls that support dependable delivery.
The most useful security improvement may be the one a delivery team no longer has to remember.
Everyone can be doing their part while a risk stays open. Who has the authority to bring the decision together?
The lasting value of testing is what the organization learns and changes after the report arrives.
Joining, changing roles, and leaving are business events. Access needs to follow them reliably.
No perspectives match. Try another topic or search.
I’ve always been curious about how things work, especially when they don’t. A quick question can turn into a surprisingly long rabbit hole.
These days, a lot of my time goes into working through problems with other people and making decisions when the right answer isn’t obvious. I enjoy a good debate, especially when it makes me reconsider something I’d taken for granted.
Outside of work, I build games, experiment with AI, and regularly underestimate what should count as a weekend project.
I use this site to explore ideas, share a few opinions, and document projects I find interesting.
I build games through Wicked Studios. I enjoy taking an idea, getting it to work, and discovering all the things I didn’t think of at the start.