Featured perspective · Leadership
AI isn't a strategy.
AI can expand what a business is capable of. Strategy decides which capabilities are worth using, why they matter, and where they should take us.
Read the perspective ↗ Security / Technology / Leadership
I write about
cybersecurity.
And sometimes
other stuff.
I’m Jesse. I lead security teams, build games, and ask a lot of questions. These are my thoughts on the work, the technology, and whatever else gets me thinking.
Explore my thinkingA CLOSER LOOK
IDENTITY AT THE CENTREHUMAN + MACHINE
Business judgmentTechnical depthLeading teamsBuilding what’s next
THE NOTEBOOK
Ideas worth exploring.
Especially about my own thinking.
AI isn't a strategy.
AI can expand what a business is capable of. Strategy decides which capabilities are worth using, why they matter, and where they should take us.
Putting AI to work safely.
AI can identify a real security problem and still recommend the wrong business decision. How do we turn useful analysis into actions we can depend on?
Support your team. Expect ownership.
A serious mistake tests more than a system. It tests whether people can tell you the truth, whether ownership means anything, and whether your help leaves the team stronger.
Passkeys change what an attacker can steal.
Passkeys remove familiar opportunities to steal and replay credentials. The real security gain depends on how we enroll them, recover access, protect sessions, and retire weaker routes.
Why RBAC is not so simple.
Roles are easy to explain and surprisingly hard to implement. Granular permissions, inherited folder access, and a practical definition of done.
Not all MFA is created equal.
Security questions should be retired. SMS, codes, and push each leave different openings. The useful question is which attack your authentication method can actually stop.
Temporary risks shouldn’t become permanent.
Exceptions can keep a business moving. They become harder to resolve when ownership is unclear, the rating understates the exposure, and renewal replaces a real decision.
Fate Lost’s co-op backend costs $0. Here’s how.
The host’s phone runs the fight. Cloudflare keeps the party together. How I built private co-op, what batching changed, and the compromises I chose to accept.
AI security needs an operating model, too.
The right path to AI adoption combines usable guidance with ownership, bounded permissions, monitoring, and a response that works.
What even is RBAC?
An accessible introduction to role-based access control, why it matters, and how it compares with ABAC and other models.
The next identity challenge doesn’t have a human behind it.
AI agents need clear authority, accountable owners, and access designed around the task they are meant to perform.
Frontier AI brings the capability. We bring the context.
The next step for security is to combine AI-driven testing with what we know about our systems, our clients, and how our businesses actually operate.
Recovery is part of authentication.
A locked-out person still needs help. The recovery process must preserve the trust established at sign-in.
Test the boundary, too.
A secure-looking component can still rely on a decision made somewhere else. Follow the trust between systems.
A security metric should help someone make a decision.
Leadership needs a clear view of exposure, progress, and the decisions that will help the business move forward.
What is a passkey anyway?
A simple explanation of the digital key behind the sign-in, followed by a closer look at the technology that makes it work.
A threat model should change a design.
Start with what could go wrong, then make a concrete decision about how the system should work.
From a list of findings to a reason to act.
Prioritize the exposure that matters, make remediation achievable, and build controls that support dependable delivery.
Secure defaults beat repeated reminders.
The most useful security improvement may be the one a delivery team no longer has to remember.
The risk nobody owns is the risk that waits.
Everyone can be doing their part while a risk stays open. Who has the authority to bring the decision together?
A penetration test should leave a better system behind.
The lasting value of testing is what the organization learns and changes after the report arrives.
Access should move with the person.
Joining, changing roles, and leaving are business events. Access needs to follow them reliably.
No perspectives match. Try another topic or search.
ABOUT JESSE
A little about me.
I’ve always been curious about how things work. I’m usually the one asking why something was built a certain way, what happens when it breaks, or whether there’s a better way to do it. These days I lead teams across enterprise identity, application security, and offensive security, but I still enjoy getting into the technical details myself.
One thing this work has taught me is that a technically sound answer isn’t always a practical one. Security has to make sense for the people using it, too. If we make it unnecessarily difficult for someone to help a client or do their job, I think we owe them a better solution.
I’ve also been spending a lot of time exploring AI, both what it makes possible and where it introduces new risks. I like trying things out and seeing what actually works. Not every new technology needs to become a big initiative, but when it can solve a real problem, I want to understand how.
I want to understand what you’re trying to do before I tell you how to secure it. The business needs to keep moving, and my job is to help us make decisions we can explain and live with.
01
What are we trying to accomplish?
Tell me what you need to get done. Launch a service? Give someone access? Put AI to work? I want to understand who depends on it, what it needs to do, and where we have room to make a different choice. A security requirement should have a reason behind it. If I can’t explain how it helps, I owe you a better answer.
02
Show me how it holds up
If we’re counting on a control to protect us, I want to see it tested. Try to get past it. Check the recovery path. Ask what happens when an account is compromised or a dependency fails. I’m quite happy to find out my assumptions were wrong while we still have time to do something about them. Then we need to use what we learned to make the system better.
03
Give people a decision they can make
When I bring you a risk, I should be able to explain what could happen, what we know, and where I’m still making assumptions. You deserve my recommendation, too. What would I do, and why? Once we decide, someone needs to own the next step and have the means to follow through. I want the conversation to leave us able to act.
BEYOND SECURITY
I also make games.
I build games through Wicked Studios. I enjoy taking an idea, getting it to work, and discovering all the things I didn’t think of at the start.