// Topic
Security
Definition
Security coverage in this archive spans 37 posts from May 2016 to Apr 2026 and frames security as continuous risk reduction instead of one-time policy work. The strongest adjacent threads are ai, devops, and incident response. Recurring title motifs include security, ai, engineering, and container.
Key claims
- The strongest pattern is operational: security controls are effective only when they are embedded in delivery flow.
- Early posts lean on security and incident, while newer posts lean on ai and security as constraints shifted.
- This topic repeatedly intersects with ai, devops, and incident response, so design choices here rarely stand alone.
Practical checklist
- Map threats to concrete controls, then tie each control to an owner and an observable signal.
- Start with the newest post to calibrate current constraints, then backtrack to older entries for first principles.
- When boundary questions appear, cross-read ai and devops before committing implementation details.
Failure modes
- Treating compliance checklists as a substitute for runtime detection and response.
- Adding controls no one owns, tests, or rehearses under incident pressure.
- Applying guidance from 2016 to 2026 without revisiting assumptions as context changed.
Suggested reading path
- Start here (current state): Sovereign Systems: Building for a World Where Data Privacy Is Non-Optional
- Then read (operating middle): Your Software Supply Chain Is Probably a Mess
- Finish with (foundational context): Security Incident Response for Startups
Related posts
- Sovereign Systems: Building for a World Where Data Privacy Is Non-Optional
- AI Security: Evolving Threats and Defenses
- AI Privacy Is a Plumbing Problem, Not a Policy Problem
- AI Security: Same Principles, New Attack Surface
- AI Safety Is Just Production Engineering
- AI Compliance Without the Theater
- LLM Security: A Field Guide for People Who Ship Things
- Responsible AI Is Just Risk Management. Treat It That Way.
References
38 posts
- AI Governance Without Bureaucracy
Effective AI governance is tighter defaults, clearer ownership, and faster escalation — not more committees.
Sovereign Systems: Building for a World Where Data Privacy Is Non-Optional
Privacy is an architecture constraint, not a feature toggle. Teams that build sovereignty into their systems early avoid painful retrofits and close enterprise deals faster.
AI Security: Evolving Threats and Defenses
As of late February 2026, AI security is defined by adaptive attacks and layered, operational defenses.
AI Privacy Is a Plumbing Problem, Not a Policy Problem
Privacy in AI systems fails in the implementation details -- what gets logged, who can replay prompts, how long artifacts linger. Treat it as infrastructure, not a compliance checkbox.
AI Security: Same Principles, New Attack Surface
AI systems are exposed APIs with real blast radius. The threats are injection, leakage, and tool misuse. The defenses are the same ones we've always needed -- just applied to a new surface.
AI Safety Is Just Production Engineering
AI safety in production isn't a research problem. It's defense in depth, the same way cyber defense works -- layered controls, assumed breach, observable boundaries.
AI Compliance Without the Theater
Compliance doesn't have to slow you down. But you have to build it into the system from day one, not bolt it on after the demo impresses the board.
LLM Security: A Field Guide for People Who Ship Things
LLMs introduce security failure modes that most teams are not defending against. Prompt injection, data leakage, tool abuse, and cost attacks are real and exploitable today.
Responsible AI Is Just Risk Management. Treat It That Way.
Responsible AI is not an ethics committee. It is operational risk management, and teams that treat it otherwise are building liabilities.
AI Safety Is Just Security Engineering With Extra Steps
AI safety is not a philosophy problem for engineers. It is reliability, security, and accountability applied to a new kind of system.
Container Scanning Without the Security Theater
Most container scanning setups generate noise, not security. Here is how to build a pipeline that actually catches what matters.
OAuth Tokens: Why They Keep Getting Stolen and How to Stop It
Bearer tokens are bearer weapons. Short lifetimes, tight scopes, encrypted storage, and real monitoring are the only defenses that matter.
Hardening Kubernetes: The Stuff That Actually Matters
Kubernetes defaults are built for getting things running, not for keeping attackers out. A layered hardening walkthrough covering pods, RBAC, network policies, secrets, and the control plane.
What Log4j Actually Taught Us
Log4j wasn't a dependency problem. It was an operational readiness problem. Here's what to fix before the next one hits.
2021: The Year Everything We Ignored Caught Fire
Personal reflections on a year of growth, supply chain security wake-up calls, and ending the year neck-deep in Log4j response.
Log4j Is on Fire. Here's What to Do Right Now.
CVE-2021-44228 is the worst vulnerability I have seen in a decade. If you run Java anywhere, stop reading the news and start inventorying.
Zero Trust Architecture: What It Actually Looks Like
Zero trust from two perspectives: my NATO background in defense systems and work at a major telecom. The architecture patterns, the implementation path, and what most companies get wrong.
Embracing Remote Work: Benefits, Dangers, and Overcoming Challenges
After years of building and running distributed engineering teams, here are the actual benefits, real dangers, and hard-won lessons about making remote work stick.
DevSecOps in Practice: What I Actually Implement
The concrete pipeline configs, policy-as-code patterns, and runtime controls I set up to bake security into delivery.
Your Software Supply Chain Is Probably a Mess
What SolarWinds taught us about supply chain security, and the concrete steps I've been implementing at enterprise scale.
SolarWinds Got Owned. Your Build Pipeline Might Be Next.
The SolarWinds supply-chain compromise is the wake-up call every software team needed. What happened, why it matters, and what you should do right now.
Your Container Image Scan Passed. Now What?
Image scanning tells you what's in the box. Runtime security tells you what the box is doing. Here's how we lock down containers at Decloud with seccomp, network policies, Falco, and paranoia earned from NATO work.
Your VPN Is a Liability. Here's What Replaces It.
VPNs trust the network. Zero trust trusts nothing. After years in NATO cyber defense and building infrastructure at Decloud, I've watched the perimeter model collapse in real time. Here's how to actually migrate.
Your Cloud Security Is Falling Apart Right Now
Everyone's scrambling to scale cloud infrastructure overnight. I've seen what happens when security gets deprioritized under pressure — at NATO exercises, at Decloud, at the fintech startup. Here's how to not become a headline.
Your Incident Response Plan Is Useless Until Someone Bleeds
Most incident response plans are shelf-ware. Here's what actually matters when your infrastructure is on fire -- drawn from real breaches, NATO cyber exercises, and startup chaos.
Kubernetes Ships Insecure by Default. Here's What to Do About It.
Kubernetes defaults optimize for fast adoption, not safety. A hardening checklist drawn from running clusters at the fintech startup, Dropbyke, and early Decloud work.
Container Security in 2018: What Actually Changed
Eight months after my first container security post, an update on what moved at the fintech startup and in the ecosystem — PodSecurityPolicy, image signing, and the shift from scratch to real.
Securing Microservices: What Actually Works
You split the monolith. Now every service-to-service call is an attack surface. Here's how I think about identity, authorization, encryption, and secrets management in distributed systems.
Zero Trust Is Not a Product. Here's How We Actually Built It.
Perimeter security is dead. At the fintech startup, I ripped out the castle-and-moat model and replaced it with zero trust — identity-first, micro-segmented, no implicit trust anywhere. Here's what that actually looked like.
Spectre and Meltdown Broke My Weekend
Five days after the Spectre/Meltdown disclosure, a CTO's raw take on what happened, what we patched, and why this changes the game for anyone running shared infrastructure.
Your Containers Aren't Secure. Here's What to Actually Do About It.
Containers give you process isolation, not a security boundary. I break down how we hardened images, locked down runtimes, and segmented networks at the fintech startup — plus the stuff nobody warns you about.
Your Startup Doesn't Need a Security Team. It Needs a Security Champion.
You can't afford a security team at a startup. But you can turn one motivated engineer per squad into a security champion — and that changes everything.
Stop Doing Security Reviews by Hand
Your manual security gate is a bottleneck pretending to be a process. Here's how I moved security checks into the pipeline at the fintech startup so we could ship fast without shipping stupid.
WannaCry Hit. Here's What It Actually Exposed.
WannaCry wasn't sophisticated. It was a known exploit with a patch already out. The real failure was organizational, and it's one most companies are still making right now.
GDPR Is an Engineering Problem, Not a Legal One
We're 15 months from GDPR enforcement. Here's the technical checklist I'm working through at the fintech startup — data inventory, consent, deletion, and everything else engineering actually has to build.
Securing APIs: Authentication and Authorization Patterns
APIs expose your systems to the world. Here's how to implement authentication and authorization that protects your data without frustrating legitimate users.
Building a Security-First Engineering Culture
Security culture is not a training program or a tool purchase. It is a set of habits that leadership enforces through consistency, not speeches.
Security Incident Response for Startups
A practical incident response playbook for small teams: define incidents, assign owners, contain fast, investigate calmly, and recover with clear communication.