I also write

My case for why security leaders need to be builders and engineers, people who can measure and improve their own systems rather than shop for tools off a shelf. Agentic AI is changing offense and defense at the same time, and buying your way out of that isn't going to work.

I lay out where I land on human-in-the-loop versus human-on-the-loop: let the agents gather the data, keep the analyst making the actual call when it matters.

A look at how prompt injection turns an AI agent against the person using it. A malicious website can steer it into doing something harmful without you ever noticing.

How I built my own self-hosted LLM setup on Proxmox with Ollama and Open WebUI, so I'm not sending anything sensitive to someone else's API.

Why I'm careful about what I put into commercial LLMs. What you type in doesn't disappear, it's a permanent record sitting somewhere, and that should worry more people than it does.

Where I introduce the newsletter and what got me writing: automation, security, and the itch to build things that actually work.

My case against reaching for an LLM by default. A lot of business problems get solved better, cheaper, and more explainably by gradient boosting, YOLO, or an isolation forest, and most AI projects fail on data readiness and workflow integration, not on the algorithm.

How I built and deployed a fine-tuned 1.5B Qwen model on Modal that turns ACLED data, news sources, and State Department advisories into a structured travel risk brief, and what it actually took to keep that running cheaply.