Archive
Writing
20 pieces, newest first.
Agent Governance Should Move to the Application Boundary
Instead of only governing which applications an agent can access, each application should decide which agents it trusts, what they may do, and how far their authority can travel.
Why I Built gh-iga: Open-Source Identity Governance for GitHub
GitHub access grows quietly across people, apps, keys, secrets, and automation. I built gh-iga to make that access visible—and to be honest when a scan is incomplete.
The Certification That Never Was
A fictional story about a real IGA failure pattern: access reviews that create evidence of governance without governance actually happening.
Cloud Breaches Don't Start in the Cloud — They End There
Most compromises begin outside the cloud, then ripple inward through identity, federation, and trust chains.
Your Verified Identity Is Now a Liability
AI agents, deepfakes, and synthetic profiles are dissolving the old boundary between verified identity and actual human trust.
Your Situation Isn't as Unique as You Think
The hidden cost of believing the rules don't apply to you.
The Guest User Blind Spot: Lessons from the Salesloft Breach
When an attacker can add a guest account without approvals or alerts, it's not a breach problem — it's an identity governance problem.
Two Types of Communicators in Corporate IT — Which One Are You?
Real-time responders and batch processors both have a place in IT. The best professionals know when to be each.
The Missing Middle: Where Humans and AI Meet
The real opportunity in the age of generative AI isn't on either extreme — it's in the space where humans and machines work together.
Weekend Read: What IGA Do You Use?
A roundup of practitioner takes on Okta, SailPoint, One Identity, Saviynt, Omada, midPoint, and Wren:IDM from a Reddit thread worth bookmarking.
Jagged Intelligence: Why AI Is Brilliant and Clumsy at the Same Time
AI can pass medical exams and solve advanced math, then fumble on something a child would handle. That unevenness has a name — and it might be permanent.
Deployment Pain: Where Dev Truly Meets Ops
It worked on my machine. Then it didn't. Every engineer has lived this gap — and it's where the real work of bridging dev and ops begins.
Hacked Data, Real Projects, Fake Invoices: The Perfect Scam Recipe
A Plymouth fraud case shows how data theft plus social engineering can bypass every control you've built — by impersonating a vendor you already trust.
Unmasking a USPS Phishing Scam: A Sandbox Walkthrough
A 'delayed package' text from USPS landed in my inbox. Three checks in a sandbox were enough to confirm it was a phishing scam.
When the Phishing Email Is Real: Booking.com's Magic Link Problem
Scammers don't need to spoof Booking.com — they trigger it to send you a real login link. MFA doesn't help. Here's why.
Humans Are Still the Weakest Link — So Build for That
A LockBit ransomware attack on a bank started with one employee clicking a link. The lesson isn't 'train harder' — it's 'design assuming the click happens.'
RockYou2024: 10 Billion Passwords and Why Credential Stuffing Is the Real Threat
The leak itself isn't the danger — it's what attackers do with it next. A practical take on why MFA stopped being optional.
The Patelco Ransomware Attack: Anatomy of a Modern Breach
A credit union with $9B in assets and 400,000 members gets hit. Walking through how ransomware actually unfolds — and what the real impact looks like.
TeamViewer and Midnight Blizzard: When Password Sprays Find an Open Door
The TeamViewer breach is a textbook case of why MFA strength — not just MFA presence — is the line between an attempted attack and a successful one.
Detecting Phishing: How I Caught a Suspicious Email
Gmail's built-in filters didn't flag this one. Six small signals — none of them obvious individually — told the real story.