CRA, NIS2 and DORA for Engineers: You Can’t Report What You Can’t See The Blast Radius runs on one conviction: prefer enforcing controls you can verify over promises you have to trust. Real security lives in invariants, the properties that hold against the worst case an adversary can construct, not…
The Case of the Toppled Plant Pot and...
The Blast Radius runs on one conviction: prefer...
Threat Modeling the Model Context Protocol: Your Agent...
From Principle to Practice: Privacy in the Real...
Untangling the Confusion People often confuse these two...
The Plan, the Order, and the Bill In...
Quantum, AI, and the Window That’s Already Closing...
Last week, Anthropic announced Claude Mythos Preview and...
Bear with me on this train of thought....
Cutting the Dead Wood from Your Dependency Graph...
Mitigating Third-Party Component Risk: Swapping the Cancer for...
How One Bad Library Can Poison Your Entire...
I’ve been talking about graphs for dependency analysis...
SAST vs Claude Code Security: A Deep Dive...
Why SAST is broken, and how it could...
Cursor as your Secure Dev Team What I...
