Security should be real. AI should stay accountable.
My professional center is cybersecurity, cloud, AI security, secure architecture, and systems that make risk visible enough to do something about it. I am not interested in checkbox theater.
Cybersecurity & AI
Cybersecurity
Security must be built into the system, not sprayed on top after the demo works. No fake production claims. No demo defaults pretending to be customer-ready. No dumping risk onto users because the builder got bored before the hardening work.
The useful version of security is practical: identity, logging, least privilege, detection, response, secure defaults, supportability, threat modeling, remediation, and documentation honest enough that a customer can trust it.
Cybersecurity & AI
AI Security
I build and think about AI systems, prompt injection, model behavior, AI tool intake, enterprise monitoring, SecOps search, classifiers, governance, and safe adoption in large organizations.
AI should be a tool, not a boss, judge, cop, priest, replacement conscience, or hidden policy engine. If a human life, job, freedom, reputation, safety, or future is affected, humans remain responsible.
Security
Secure Architecture
Security work starts with the shape of the system: identity, trust boundaries, data paths, logging, failure modes, and the parts attackers will touch first. A useful architecture makes those things explicit before production pressure turns them into folklore.
- Map trust boundaries before adding new privileges.
- Make logging and evidence part of the launch path.
- Prefer secure defaults that operators can understand and support.
AI Systems
AI Governance
Enterprise AI needs policy, monitoring, intake, review, and accountability in one place. The goal is not to block useful work. The goal is to keep hidden AI behavior from turning into hidden policy.
The durable pattern is a control plane: approved tools, model-use visibility, risk tiers, logging, review paths, and human accountability where consequences matter.
AI Systems
Prompt-Injection Defense
Prompt injection is a systems problem. The model sees text, tools, memory, and user intent inside one context window, so the application has to decide which instructions deserve authority.
- Separate trusted instructions from retrieved or user-supplied text.
- Gate tools with policy outside the model.
- Treat exfiltration attempts as workflow failures, not prompt failures.
Cybersecurity & AI
Current lanes
-
Enterprise AI convergence
A single point of policy, monitoring, governance, and visibility for AI interactions across a messy enterprise: manufacturing, office work, security, engineering, and shadow AI.
-
Prompt-injection defense
Classifying plain-language tricks, math-shaped instructions, fake grandma stories, roleplay bypasses, data-exfil attempts, and the soft manipulations that models mistake for context.
-
SecOps search
Indexing cyber and AI-security knowledge, code repositories, exploit data, advisories, authorized research, and internal context so defenders can find signal faster.
-
Cloud and platform security
AWS, Linux, Go, IAM, monitoring, architecture, hardening, evidence, and secure systems people can actually operate after launch day.
-
Product-grade review
Finding stubs, placeholders, fake readiness claims, demo secrets, missing controls, brittle paths, and trust gaps before customers or attackers do.
-
Human-first controls
Controls that reduce risk without punishing users into bypassing them. Security that protects the mission instead of becoming the mission.