Essays

First-principles writing on AI systems, security operations, and the systems that protect everything else.

Know Thy Enemy

Sun Tzu said the enemy's plans could only be learned from spies. This fall the attacker's planner was on GitHub. Reading ARTEX and PentAGI shows a coding agent that treats the model as a setting, keeps its plans in markdown, and goes for the edges nobody counted. Knowing the enemy got cheap. Knowing yourself didn't.

ai security-operations offensive-security threat-intelligence

The Paranoid SOC

An AI SOC knows every way your company could be attacked and almost nothing about how it runs, so it finds APTs in your inventory job. Treating every alert as a true positive means naming the routine behind it as specifically as the attack, and that takes knowing your company like a five-year veteran.

security-operations ai soc investigation

The Eager SOC

A security investigation is slow because it gathers context the way it always has: reactively, one artifact at a time, because thinking used to be the expensive step. Cheap calibrated decision models flip that. Pull the whole context bundle up front, decide once, and you can score every event instead of the few a detector flagged.

security-operations detection-engineering ai soc

The Sycophantic SOC

A story about a self-improving SOC that did everything right: three correct dismissals, a model that learned from each one, and an intrusion that walked through the boundary it drew. Analyst feedback can only describe attacks that happened. The value of a detection lives in the ones that haven't.

ai security-operations self-improvement red-teaming machine-learning

Everyone Is an IC Now, and Nobody Is in Flow

AI harnesses reward long solo sessions, so collaborative roles are turning into individual contributor roles. But the solo time they produce is supervision, not flow. Managers lost the room; engineers lost the zone; both landed in the same new mode.

ai engineering-leadership collaboration ai-harnesses

Triage Doesn't Produce a Verdict. It Produces Residual Risk.

Anton Chuvakin is right that triage must die. But the filter is only half of it: the binary verdict is the real 2003 artifact. An investigation never proves 'benign'; it runs out of budget. The honest output isn't true-positive or false-positive. It's the risk you couldn't rule out.

security-operations soc verifiability detection-engineering ai

How to Train Your AI Attacker

Walk through the actual RL loop that makes an AI better at breaking in, cell by cell. Then run the identical loop for defense and watch it die at one cell, the reward, which is why offense keeps pulling ahead.

ai security-operations verifiability machine-learning

The Unbounded Investigation

One risky sign-in alert, five good analysts, five different investigations, all defensible. Why a security investigation has no natural end, why 'benign' has no proof, and the one move that makes detection measurable.

security-operations soc verifiability detection-engineering

The Work You Can't Check

Some work you can check in seconds. Some you can never check at all. That gap, verifiability, quietly decides how work gets trusted and priced, and where AI actually creates value.

ai verifiability security-operations

A Patch Going Public Is an Attack Map Going Public

Patch-diffing was never new - attackers have turned fixes into N-days for decades. What changed is the labor. When an agent can read a fix and build the payload in an afternoon, the exposure window becomes a race you're now losing by default.

security-operations ai supply-chain detection-engineering

AI SOC Rewrites the Shared Responsibility Contract

SOAR and AI SOC aren't two flavors of the same tool. They're two different contracts with your vendor - and the shift moves your best people from monitoring the queue to aligning the system.

security-operations ai soc detection-engineering

The $1 Trillion Signal That Was Sitting on a Job Board

Frontier AI capabilities don't debut at keynotes. They're assembled in training data pipelines - and the hiring patterns are visible months in advance.

ai cybersecurity frontier-models training-data

Architecture Designed for Removal

Every system in history was designed to last. AI agent architecture is the first that should be designed to disappear. The best code you write today is code that becomes unnecessary tomorrow.

ai agents architecture security-operations

WTF Is Security Context

The industry uses 'context' as a synonym for 'more data.' It's not. Here's a first-principles framework for what context actually means - from events to chains to storylines - and why most SOCs are stuck at Layer 1.

security-operations soc detection-engineering architecture

AI-Powered Security Starts with Your Tribal Knowledge

The greatest vulnerability in the modern SOC is not a lack of data - it is a lack of memory. How tribal knowledge, context lakes, and a new role called the Context Analyst change everything.

security-operations ai soc architecture

Why a Fixed Capacity SOC Is a Liability

We treat the SOC as a defensive funnel, but functionally it's a bottleneck. When attack volume goes exponential, a fixed capacity model forces you to ignore the vast majority of signals to save the sanity of the team.

security-operations ai soc detection-engineering

Why Every Dismissed Alert Is Technical Debt

Maliciousness isn't an inherent property of an event - it's a property of its relationship to future context. Every dismissed alert is a liability on your balance sheet.

security-operations soc detection-engineering

The Overfitting Problem in Detection Engineering

Every time you tune a detection rule to silence a noisy alert, you're hard-coding a blind spot. We're trading false positives for false negatives.

detection-engineering security-operations soc

Why Long Context Windows Create an Asymmetric Advantage for Attackers

AI's expanding context windows sound like a defensive breakthrough. In reality, they're structurally easier for attackers to exploit - attackers save the whole board state while defenders rebuild from fragments every move.

ai security-architecture threat-intelligence

SecOps Is Chaos Engineering

Security is theoretically simple. But SecOps in practice is a war against entropy - where the real task isn't correlation, it's intent recognition.

security-operations soc detection-engineering

The Scaffolding Trap in Agent Architecture

Teams build elaborate state machines to compensate for model limitations. The result benchmarks well - and doesn't think. Your architecture is a commitment, not a snapshot.

ai agents architecture security-operations

The Great Unbundling of RAG: Why AI Agents Are Building Their Own Context

We spent two years perfecting our RAG pipeline. Then our AI started reading markdown files from a filesystem instead of querying our vector store. This isn't a bug - it's the future.

ai agents rag architecture

The Detection Bias Trap: Why AI SOC Evolution Needs Adversarial Balance

AI SOCs inherit and amplify human bias - favoring detections that reduce workload over ones that maximize threat coverage. Without a sparring partner, even AI-generated rules drift conservative.

ai soc detection-engineering security-operations

The Homunculus Fallacy - and Why GPT-5 Might Be Walking Right Into It

You can't explain intelligence by inserting another intelligent agent. If GPT-5's router needs sophisticated judgment to route intelligence, who's routing the router?

ai philosophy architecture

Risk Is Unquantifiable

Howard Marks argues you can't quantify risk even after the fact. We've built an entire vulnerability management industry around measuring the unmeasurable.

risk-management vulnerability-management security-leadership

The False Positive Rate: First Casualty of AI-driven SOC Operations

False Positive Rates were never about detection accuracy - they were always about human capacity. AI triage changes the equation entirely.

security-operations ai soc detection-engineering

The Bitter Lesson in Security Operations

Sutton's Bitter Lesson says intelligence emerges from scalable learning, not encoded knowledge. Does that mean we'll outgrow MITRE ATT&CK?

ai security-operations detection-engineering philosophy

Impedance Mismatch: The Data Engineering Challenge at the Heart of Security Operations

SecOps reasoning is graph-based but our data arrives as time-series logs. This impedance mismatch - like ORMs bridging objects and tables - is the core data engineering problem in security.

security-operations data-engineering architecture