Cybersecurity
Performed security and genuine security produce the same documentation. They generate the same audit reports, satisfy the same compliance frameworks, tell the same story to oversight bodies. The difference only becomes visible when the adversary shows up. The adversary has shown up.
Cybersecurity
Compound loading: when multiple forces act on a structure simultaneously, the failure threshold drops. Chinese intelligence inside telecom networks. Federal cybersecurity capacity dismantled from within. A still-active adversary operating inside systems that haven't been remediated.
Cybersecurity
Every security professional is trained to prevent the insider threat. What happened over the past year is something I didn't expect to see: the deliberate, systematic dismantlement of the controls that insider threat programs are built to provide, by the government itself, applied to its own systems
Cybersecurity
Seven years. That's how long the patches were available. When Salt Typhoon arrived, it didn't need to break anything. It needed to find what had never been repaired. This is the story the Salt Typhoon hack actually tells, and it isn't primarily about China.
Essays
The finance worker at Arup did everything right. He requested a video call to verify. He looked at the screen and used his judgment. His judgment told him this was real. It wasn't. Twenty-five million gone. The pamphleteer doesn't count on the forgery. He counts on your inability to detect it.
Essays
Universities are being hollowed out while AI makes institutional formation seem unnecessary. Both forces share a blind spot: how people develop the judgment to use powerful tools wisely. The Renaissance faced a similar convergence.
Essays
Ian McKellen told Stephen Colbert that theatre is an irreplaceable human encounter, then described a production where the actors aren't in the room at all. The contradiction between these two claims may be more useful than either one alone.
I publish long-form essays on security, systems, and AI when the thinking is ready. No schedule, no noise. Subscribe to receive them directly.
Synthetic media is everywhere. AI generates images, curates feeds, and simulates experience at scale. But as representation expands, something else is quietly becoming scarce, and it may be the only thing that still matters.
There is a seductive logic to simulation: if a system can be modeled accurately, hypotheses can be tested without the cost and risk of physical experiments. But simulation runs on models, and models encode what is known, not what remains unknown.
Synthetic media has broken the old link between sight and truth. Images, audio, and video can no longer stand as evidence on their own. As fabrication becomes easy and detection uncertain, visual trust collapses, and new norms for verification become essential.
The public conversation about AI has been captured by generative models. But most economic value comes from systems that rarely make headlines: predictive models, recommendation engines, optimization algorithms, classical AI built on high-quality data, running quietly in the background.
For most of the history of software, there was a hard line between people who could build things and people who could only describe what they wanted built. Generative AI has made that line porous. Not erased, but dramatically lower for prototyping and exploration.
There's a seductive compression that happens when organizations talk about AI. Productivity becomes capability, capability becomes intelligence, and before long people are talking as if the system that drafts emails might also make strategic decisions.
Plot the Dunning-Kruger curve next to the Gartner Hype Cycle and you get the same shape. That's not a coincidence. It reveals a coupling between individual psychology and collective technological adoption that most analyses miss entirely.
There's a pattern in how organizations first encounter AI: someone discovers a chatbot, has a striking conversation, and becomes convinced that AI is a destination. The organizations extracting the most value have moved past that assumption entirely.
AI systems arrive as general-purpose tools, trained on broad datasets and marketed on their versatility. But generality comes with a cost: a system that can do anything adequately often does nothing particularly well. Generic capability translates into generic output.
Most of the time, when AI falls short, the problem is that the task wasn’t framed well. The very same model that gives you bland or useless output in one setup can produce work that’s genuinely helpful in another, simply because the way you described and structured the task changed.
AI systems produce outputs that read as if created by someone who knows what they're talking about. The grammar is correct, the structure logical, the confidence unwavering. This fluency creates a problem: the surface features of credibility are present even when the underlying substance is wrong.
The first and most fundamental misunderstanding about AI is that it replaces human capability. This belief shows up as fear, as hope, and as business cases built on headcount reduction. Each version misreads what these systems actually do.