Featured perspective · Identity
Outlook has a credential problem.
An Outlook vulnerability can expose Windows authentication information. The interesting part is why an email application can make that happen.
Read the perspective ↗ Security / Technology / Leadership
Cybersecurity, curiosity, and the occasional side project.
I spend most of my days leading teams and untangling complicated technology problems. I still enjoy getting into the details, and outside of work I build games and experiment with AI. This is where I share the things that catch my attention, along with a few opinions I’m still working through.
Explore my thinkingA CLOSER LOOK
IDENTITY AT THE CENTREHUMAN + MACHINE
Business judgmentTechnical depthLeading teamsBuilding what’s next
THE NOTEBOOK
Things I’ve been thinking about.
Outlook has a credential problem.
An Outlook vulnerability can expose Windows authentication information. The interesting part is why an email application can make that happen.
PHP2Shell: A Cookie Shouldn't Do That.
A PHP session cookie can accidentally leak server memory. And that's just one of the strange things about PHP2Shell.
AI isn't a strategy.
AI can expand what a business is capable of. Strategy decides which capabilities are worth using, why they matter, and where they should take us.
Giving AI the ability to act changes the risk
AI can identify a real security problem and still recommend the wrong business decision. How do we turn useful analysis into actions we can depend on?
Support your team. Expect ownership.
A serious mistake tests more than a system. It tests whether people can tell you the truth, whether ownership means anything, and whether your help leaves the team stronger.
Passkeys change what an attacker can steal.
Passkeys remove familiar opportunities to steal and replay credentials. The real security gain depends on how we enroll them, recover access, protect sessions, and retire weaker routes.
Why RBAC is not so simple.
Roles are easy to explain and surprisingly hard to implement. Granular permissions, inherited folder access, and a practical definition of done.
Not all MFA is created equal.
Security questions should be retired. SMS, codes, and push each leave different openings. The useful question is which attack your authentication method can actually stop.
Temporary risks shouldn’t become permanent.
Exceptions can keep a business moving. They become harder to resolve when ownership is unclear, the rating understates the exposure, and renewal replaces a real decision.
Fate Lost’s co-op backend costs $0. Here’s how.
The host’s phone runs the fight. Cloudflare keeps the party together. How I built private co-op, what batching changed, and the compromises I chose to accept.
AI security doesn’t end at launch
The right path to AI adoption combines usable guidance with ownership, bounded permissions, monitoring, and a response that works.
What even is RBAC?
An accessible introduction to role-based access control, why it matters, and how it compares with ABAC and other models.
AI agents need identities, too
AI agents need clear authority, accountable owners, and access designed around the task they are meant to perform.
AI can find weaknesses. Context tells us what matters.
The next step for security is to combine AI-driven testing with what we know about our systems, our clients, and how our businesses actually operate.
Recovery is part of authentication.
A locked-out person still needs help. The recovery process must preserve the trust established at sign-in.
The security gaps between systems
A secure-looking component can still rely on a decision made somewhere else. Follow the trust between systems.
What the security dashboard doesn’t tell you
Leadership needs a clear view of exposure, progress, and the decisions that will help the business move forward.
What is a passkey anyway?
A simple explanation of the digital key behind the sign-in, followed by a closer look at the technology that makes it work.
Threat modelling should change the design
Start with what could go wrong, then make a concrete decision about how the system should work.
A vulnerability backlog is not a risk assessment
Prioritize the exposure that matters, make remediation achievable, and build controls that support dependable delivery.
Stop asking developers to remember everything.
The most useful security improvement may be the one a delivery team no longer has to remember.
When shared ownership becomes nobody’s job
Everyone can be doing their part while a risk stays open. Who has the authority to bring the decision together?
The work doesn’t end with the pentest report
The lasting value of testing is what the organization learns and changes after the report arrives.
Access gets messy when people change roles
Joining, changing roles, and leaving are business events. Access needs to follow them reliably.
No perspectives match. Try another topic or search.
ABOUT JESSE
A little about me.
I lead security teams working across identity, application, cloud, AI, and offensive security. I got into this field because I like figuring out how things work, and probably even more, figuring out how they break.
These days, I spend as much time helping people make decisions as I do thinking about the technology itself. I still enjoy getting into the technical details, though. I don’t think that part ever really goes away.
Outside of work, I build games, experiment with AI, and generally start more projects than I have time to finish. This site is where I share some of what I’m working on, what I’ve learned, and whatever else has me thinking.
I don’t think security needs to be complicated for the sake of being complicated. Understand the problem, challenge the assumptions, and make a decision. Sounds simple enough, although we have a remarkable ability to make it otherwise.
01
Understand the actual problem
Before recommending a solution, I want to understand what we’re trying to accomplish and what’s getting in the way. Security should help the business move forward, not become a separate problem to solve.
02
Prove it works
A control that looks good on paper doesn’t mean much if it falls apart in practice. Test it, challenge it, and see what happens when things go wrong. I’d rather find out something doesn’t work before an attacker does.
03
Make the decision
I’d rather make a call with what we know than spend weeks talking about it. If we got something wrong, fix it and move on.
BEYOND SECURITY
I also make games.
I build games through Wicked Studios. I enjoy taking an idea, getting it to work, and discovering all the things I didn’t think of at the start.