Writing

Writing Security Invariants Got Easy. Keeping Them True Didn't.

In 2022, the first candidate on Alex Smolen’s list of security invariants was ‘all software services use single sign-on’. Four years on, a model can write that check in seconds. What it takes to keep it true — an engine, a seed of three files, and an honest place for exceptions — is the part worth designing.

Tuesday, October 13, 2026 | 16 minutes Read

Reputation Risk Is Dead — I Went Looking For The Body

Reputational damage is scored High in every threat model I review. The chain it depends on breaks at the first link, and low churn turns out to measure switching costs rather than goodwill. Then I checked whether the cost had simply moved somewhere else, and it hadn’t.

Thursday, October 8, 2026 | 14 minutes Read

Akumo: An Offensive Framework That Refuses to Lie to You

Most cloud attack tooling is confidently wrong the moment it cannot see everything — and on a real engagement, it never can. Akumo is built the other way round: it tracks what it has proven versus what it is guessing, and it can undo what it does. A tour of the idea, the internals, and how to write a technique.

Thursday, September 24, 2026 | 13 minutes Read

Governing AI-DLC, Part 1: Your Backlog Becomes a Queue of Human Decisions

Every tracker ever built assumes the expensive part of software is writing it. Agents broke that assumption, and it takes project management with it — the board, the metrics, the job titles, and the screen where somebody clicks approve forty times a day.

Sunday, September 20, 2026 | 10 minutes Read

Governing AI-DLC, Part 2: Security Gaps in AI Delivery Platforms, and How to Close Them

AWS has shipped the most serious platform yet for running delivery with agents — approval gates, automatic checks, full traceability. Then it stores the thing that defines those gates as editable data in an admin panel, and nothing checks the change that removes a check.

Sunday, September 20, 2026 | 12 minutes Read

Governing AI-DLC, Part 3: How to Know Your AI-Assisted Delivery Is Actually Safe

Story points measured how much a team could build. Machines settled that question. The number worth watching now is how much safety you get per minute of human judgement — and the checks that produce it turn out to have a proper name, and a hundred years of theory behind them.

Sunday, September 20, 2026 | 12 minutes Read