// Topics / Security

Security

43 entries tagged “Security”

    Shadow AI Is an Operating Problem, Not a Ban · 4 min Banning AI tools removes your visibility, not the tools. Make the governed path the fast path and pull usage into the control plane. governance ai security Agent Identity Is the New Control Plane · 4 min An agent that acts needs an identity—scoped, short-lived, attributable, revocable—not a shared API key. ai reliability security Sovereignty-by-Design for AI: How to Win Regulated Enterprise Deals · 4 min Sovereignty is an architecture you can demonstrate, not a checklist you assert. Trust boundaries decide revenue boundaries. ai privacy governance AI Governance Without Bureaucracy · 2 min Effective AI governance is tighter defaults, clearer ownership, and faster escalation — not more committees. governance ai security Sovereign Systems: Building for a World Where Data Privacy Is Non-Optional · 6 min Privacy is an architecture constraint, not a feature toggle. Building sovereignty in early avoids painful retrofits and closes enterprise deals faster. privacy security compliance AI Agent Operations and the Networking Bottleneck: Why AI Agents Fail on Legacy Infrastructure · 7 min Most AI agent failures are infrastructure failures, not model failures. Legacy networking and missing circuit breakers are the real reliability bottleneck. agents infrastructure security AI Security: Evolving Threats and Defenses · 7 min As of late February 2026, AI security is defined by adaptive attacks and layered, operational defenses. security ai production AI Privacy Is a Plumbing Problem, Not a Policy Problem · 5 min Privacy in AI systems fails in the details: what gets logged, who can replay prompts, how long artifacts linger. Treat it as infrastructure, not a checkbox. privacy ai data AI Security: Same Principles, New Attack Surface · 5 min AI systems are exposed APIs with real blast radius. The threats are injection, leakage, and tool misuse. The defenses are the ones we've always needed. security ai production AI Safety Is Just Production Engineering · 5 min AI safety in production isn't a research problem. It's defense in depth, the same way cyber defense works -- layered controls, assumed breach, observable boundaries. ai governance production AI Compliance Without the Theater · 5 min Compliance doesn't have to slow you down. But you have to build it into the system from day one, not bolt it on after the demo impresses the board. ai compliance business LLM Security: A Field Guide for People Who Ship Things · 6 min LLMs bring security failure modes most teams aren't defending against. Prompt injection, data leakage, tool abuse, and cost attacks are exploitable today. security llm ai Responsible AI Is Just Risk Management. Treat It That Way. · 3 min Responsible AI is not an ethics committee. It is operational risk management, and teams that treat it otherwise are building liabilities. ai security governance AI Safety Is Just Security Engineering With Extra Steps · 4 min AI safety is not a philosophy problem for engineers. It is reliability, security, and accountability applied to a new kind of system. ai governance security Container Scanning Without the Security Theater · 4 min Most container scanning setups generate noise, not security. Here is how to build a pipeline that actually catches what matters. containers security ci-cd OAuth Tokens: Why They Keep Getting Stolen and How to Stop It · 7 min Bearer tokens are bearer weapons. Short lifetimes, tight scopes, encrypted storage, and real monitoring are the only defenses that matter. security cost incident-management Hardening Kubernetes: The Stuff That Actually Matters · 7 min Kubernetes defaults favor convenience over security. A layered hardening guide covering pods, RBAC, network policies, secrets, and the control plane. kubernetes security devops What Log4j Actually Taught Us · 5 min Log4j wasn't a dependency problem. It was an operational readiness problem. Here's what to fix before the next one hits. security technical-debt incident-management 2021: The Year Everything We Ignored Caught Fire · 5 min Personal reflections on a year of growth, supply chain security wake-up calls, and ending the year neck-deep in Log4j response. year-in-review security reflection Log4j Is on Fire. Here's What to Do Right Now. · 5 min CVE-2021-44228 is the worst vulnerability I have seen in a decade. If you run Java anywhere, stop reading the news and start inventorying. security engineering incident-management Zero Trust Architecture: What It Actually Looks Like · 6 min Zero trust from two angles: national cyber-defense systems and a major telecom. The architecture patterns, implementation path, and what most companies get wrong. security architecture infrastructure Embracing Remote Work: Benefits, Dangers, and Overcoming Challenges · 6 min After years of building and running distributed engineering teams, here are the actual benefits, real dangers, and hard-won lessons about making remote work stick. remote-work leadership teams DevSecOps in Practice: What I Actually Implement · 7 min The concrete pipeline configs, policy-as-code patterns, and runtime controls I set up to bake security into delivery. security devops ci-cd Your Software Supply Chain Is Probably a Mess · 8 min What SolarWinds taught us about supply chain security, and the concrete steps I've been implementing at enterprise scale. security ci-cd SolarWinds Got Owned. Your Build Pipeline Might Be Next. · 5 min The SolarWinds supply-chain compromise is the wake-up call every software team needed. What happened, why it matters, and what you should do right now. security incident-management Your Container Image Scan Passed. Now What? · 8 min Image scanning tells you what's in the box. Runtime security tells you what it's doing. How we lock down containers with seccomp, network policies, and Falco. containers security kubernetes Your VPN Is a Liability. Here's What Replaces It. · 6 min VPNs trust the network. Zero trust trusts nothing. From national cyber-defense to Decloud, I've watched the perimeter model collapse. How to actually migrate. security infrastructure Your VPN Was Never a Security Architecture · 4 min COVID broke everyone's VPN. Good. It was a terrible security model to begin with. The answer isn't scaling your VPN — it's replacing the mental model entirely. infrastructure security remote-work Your Cloud Security Is Falling Apart Right Now · 7 min Everyone's scaling cloud infrastructure overnight. Security doesn't degrade under that pressure — it collapses. Make the secure path the easy path. security cloud infrastructure Your Incident Response Plan Is Useless Until Someone Bleeds · 7 min Most incident response plans are shelf-ware. What actually matters when your infrastructure is on fire, drawn from real breaches and national cyber-defense exercises. security incident-management devops Kubernetes Ships Insecure by Default. Here's What to Do About It. · 5 min Kubernetes defaults optimize for fast adoption, not safety. A hardening checklist from running production clusters at three startups. kubernetes security infrastructure Container Security in 2018: What Actually Changed · 3 min Eight months after my first container security post: what moved at the fintech startup and in the ecosystem — PodSecurityPolicy, image signing, scratch images. security containers kubernetes Securing Microservices: What Actually Works · 7 min You split the monolith. Now every service-to-service call is an attack surface. How I think about identity, authorization, encryption, and secrets management. security microservices architecture Zero Trust Is Not a Product. Here's How We Actually Built It. · 5 min Perimeter security is dead. How I replaced castle-and-moat at the fintech startup with zero trust — identity-first, micro-segmented, no implicit trust. security architecture infrastructure Spectre and Meltdown Broke My Weekend · 4 min Five days after the Spectre/Meltdown disclosure: what happened, what we patched, and why it changes the game for anyone on shared infrastructure. security infrastructure Your Containers Aren't Secure. Here's What to Actually Do About It. · 5 min Containers give you process isolation, not a security boundary. How we hardened images, locked down runtimes, and segmented networks at the fintech startup. containers kubernetes security Your Startup Doesn't Need a Security Team. It Needs a Security Champion. · 5 min You can't afford a security team at a startup. But you can turn one motivated engineer per squad into a security champion — and that changes everything. security startups engineering Stop Doing Security Reviews by Hand · 4 min Your manual security gate is a bottleneck pretending to be a process. Here's how I moved security checks into the pipeline at the fintech startup. security devops ci-cd WannaCry Hit. Here's What It Actually Exposed. · 4 min WannaCry wasn't sophisticated -- a known exploit with a patch already out. The real failure was organizational, and most companies are still making it. security incident-management GDPR Is an Engineering Problem, Not a Legal One · 6 min We're 15 months from GDPR enforcement. The technical checklist I'm working through at the fintech startup: data inventory, consent, deletion, retention. compliance privacy security Securing APIs: Authentication and Authorization Patterns · 6 min APIs expose your systems to the world. Here's how to implement authentication and authorization that protects your data without frustrating legitimate users. security api Building a Security-First Engineering Culture · 5 min Security culture is not a training program or a tool purchase. It is a set of habits that leadership enforces through consistency, not speeches. security engineering teams Security Incident Response for Startups · 9 min A practical incident response playbook for small teams: define incidents, assign owners, contain fast, investigate calmly, and recover with clear communication. security incident-management startups
All topics →