Writing
From the newsletter.
Practical writing on cybersecurity, privacy, and AI governance — covering everything from emerging threats to regulatory compliance. Published on Substack — surfaced here.
November 11, 2026
Anonymous Mobile Service with Only a ZIP Code: What It Means for Your Privacy
A practical guide to a new kind of mobile anonymity (and how to use it safely)
Read on Substack →November 9, 2026
Your AI Passed the Red Team Test. Can You Prove It?
Why the next frontier in AI security is turning adversarial testing into measurable, auditable evidence of risk management.
Read on Substack →November 6, 2026
Your AI Vendor Passed the Audit. So Why Is It Still a Risk?
The CISO's guide to moving beyond annual questionnaires and building continuous, evidence based oversight of third-party AI.
Read on Substack →November 4, 2026
Lock Down Your Browsers: A Friendly Guide to Hardening Brave and Firefox
Simple, quick changes that make your everyday browsing quieter, safer, and less trackable
Read on Substack →November 2, 2026
When AI Decides the Rules Are Optional: The Claude Election Data Incident
Claude’s access to Georgia election data raises a critical question: Who controls the boundaries of autonomous AI?
Read on Substack →October 30, 2026
The Human Oversight Illusion: Can You Prove Someone Actually Reviewed the AI?
Article 14 demands meaningful human control. Here's how intervention metrics, smarter interfaces, and audit trails can turn compliance promises into evidence.
Read on Substack →October 28, 2026
When RoboCop Becomes Real: Police Testing Apple Vision Pro for Mass Surveillance
California police departments are quietly deploying $3,500 Apple headsets to create virtual command centers accessing your location, security cameras, and criminal databases anywhe…
Read on Substack →October 26, 2026
The AI Gateway That Stole the Keys: Inside the LiteLLM Supply Chain Attack
How a compromised AI software release turned trusted development environments into credential harvesting targets, and what it reveals about the security controls behind enterprise…
Read on Substack →October 23, 2026
From ISO 27001 to ISO 42001: Your AI Audit Program Is Already Halfway Built
How GRC teams can leverage existing security controls, audit processes, and risk management practices to prepare for AI certification without rebuilding compliance from scratch.
Read on Substack →October 21, 2026
Ghosts in the Machine: Unidentified Surveillance Cameras and the Danger of Normalization
When phantom license plate readers quietly record our movements, they reveal how unchecked surveillance infrastructure invites exploitation by anyone, friend or foe.
Read on Substack →October 19, 2026
Five AI Projects, One Bigger Question: Can We Make Technical Communication More Trustworthy?
Exploring the intersection of technical writing, cybersecurity, knowledge management, and responsible AI through five practical software projects.
Read on Substack →October 16, 2026
Your AI Risk Register Is Already Outdated: Why Governance Needs Live Telemetry
Beyond spreadsheets and annual assessments: How continuous monitoring, realtime risk signals, and automated escalation can transform AI governance from a compliance exercise into a…
Read on Substack →October 14, 2026
The Hidden Risk in Your Browser: Why Extensions Are a Growing Security Threat
A practical guide to understanding and controlling browser extension risks
Read on Substack →October 12, 2026
Your AI Has an Audit Trail Problem, and Git Alone Won't Fix It
Why version controlling prompts, model weights, and AI configurations is becoming essential to cybersecurity, regulatory accountability, and trustworthy AI governance.
Read on Substack →October 9, 2026
From Policy to Prompt: Why AI Governance Belongs in Your CI/CD Pipeline
Stop treating AI governance as a document review. Start treating it as an engineering discipline that tests controls, catches risky integrations, and produces evidence before your…
Read on Substack →October 7, 2026
Web Cache Deception: When Speed Optimizations Turn Into Data Leaks
Why a Simple URL Trick Can Expose Sensitive Information
Read on Substack →October 5, 2026
AI Governance Is Not a Legal Project
Why the organizations that succeed will treat AI governance as a controls, evidence, and engineering problem
Read on Substack →October 2, 2026
Your AI Agent Has Permissions. Now Give It Guardrails.
Why the NIST AI RMF’s Manage Function May Become One of the Most Important Security Frameworks for Agentic AI
Read on Substack →September 30, 2026
The Cyber Tripwire Hiding in Plain Sight
How Canary Tokens Can Alert You the Moment Someone Starts Snooping
Read on Substack →September 28, 2026
AI Is Entering Critical Infrastructure. NIST Is Asking What Trust Should Look Like.
The proposed AI Risk Management Framework profile could give infrastructure operators and AI vendors a shared way to define, test, and communicate trustworthy AI.
Read on Substack →New articles published regularly. Free to subscribe.