Series
Security, Reconsidered
Things I thought I understood about infrastructure security until I started testing them.
- 01
I Thought Security Meant Blocking the Attack
The first thing I had to unlearn about infrastructure security wasn't a technique. It was what 'working' meant.
1 Jun 2026 · 10 min read
- 02
The Castle Was Never the Problem
The castle-and-moat model isn't wrong because perimeters are useless. It's wrong because it teaches you to stop asking questions the moment something is denied entry.
22 Jun 2026 · 10 min read
- 03
When Prevention Isn't Detection
Most security stacks conflate 'we stopped it' with 'we understood it.' The gap between those two claims is where the expensive incidents live.
20 Jul 2026 · 10 min read
- 04
The Security Control That Worked Too Well
Effectiveness and accountability are not the same property. A control can have both, or either, or neither, and the failure mode of 'either' is easy to miss.
24 Aug 2026 · 9 min read
- 05Coming soon
- 06Coming soon
- 07Coming soon
- 08Coming soon