Writing and thinking about information security. Helping organizations build resilient security postures through assessment, architecture, and compliance.
Comprehensive security solutions tailored to your organization.
Know where you stand before an attacker shows you. Our assessments go beyond automated scans to uncover real risks in your environment.
Build security into your infrastructure from the ground up. We design network architectures that are secure by default and resilient by design.
Compliance does not have to be painful. We help you meet regulatory requirements efficiently while building a governance program that adds real value.
Control who has access to what and when. We help you implement IAM frameworks that balance security with usability.
Thinking out loud about security, risk, and what it means to protect systems.
The $60 TV Box On Your Network Is Working For Somebody Else Last week we wrote about what happens when the company you trust to vouch for other companies quietly quits. The certificate authority story. The lesson was about delegated trust. There is a harder version of that lesson, and Google announced it on November […]
Your Certificate Authority Quit. Here’s What That Says About How You Manage Trust Last week we made the case that the front door to your network is no longer the front door. Verizon’s 2026 Data Breach Investigations Report put vulnerability exploitation ahead of stolen credentials for the first time, and the advice was unglamorous: know […]
The Vulnerability Era: Why Your Next Breach Probably Won’t Start With a Stolen Password There’s a quiet shift happening in how companies get broken into, and most security programs are still aimed at the wrong target. For two decades, the standard breach story has been the same: someone clicks a phishing link, hands over credentials, […]
Ready to get serious about security? Tell me about your situation.