Posts

The model behind Claude Code has no memory of its own, and the saved transcript it relies on isn't built for skimming and doesn't stick around forever. Here's the skill I use to leave myself a searchable, readable trail so I can pick a project back up after months away.

A practical playbook for experienced IT people who are new to AI coding assistants: instructions files, tests-first development, mandatory review, and the one rule that keeps all of it safe.

I built a public MCP server exposing live MeshCore mesh telemetry to AI agents. Here's how I secured it with zero authentication.

Ransomware locks your files and demands payment to get them back. Here's how it works, how it gets in, and what actually protects you against it.

You clicked something suspicious, your computer is acting strange, or someone just told you your account sent emails you didn't write. Here's what to do in the next hour.

Most small businesses skip written security policies because they assume that's an enterprise problem. It isn't. Here's why that assumption is costing you, and how to find someone trustworthy to help fix it.

How to back up a home lab fileserver to Backblaze B2 using rclone's crypt remote: client-side encryption, filename obfuscation, and automated nightly runs for about $2.50/month.

A nine-year-old bug in the Linux kernel lets any logged-in user become root in seconds, on nearly every Linux server and desktop released since 2017. Here is what it is, how it works, and what to do about it.

A ransomware negotiator feeding victims’ insurance limits to BlackCat, an OAuth mistake that cost Vercel, 163 Microsoft patches, a new ransomware gang experimenting with post-quantum crypto, 481 Oracle patches, and NIS2 enforcement going live.

The AI model in your chatbot has no memory, no internet access, and no ability to act alone. Everything else is software built around it. Here is how it fits together.

There is a straight, traceable line from a hotel meeting in 1953 to a president who tells you inflation is defeated while your grocery bill says otherwise. This is that line.

Iran's IRGC struck AWS data centers in UAE and Bahrain — the first confirmed kinetic attack on commercial cloud infrastructure. It won't be the last.

A pro-Iran group wiped 80,000 devices across 79 countries using one compromised Intune admin account. No malware, no zero-days. Here's what it means.

Five stories worth your attention: APT28's revived toolkit, a Cisco SD-WAN zero-day since 2023, AI agent security, and CISA's leadership vacuum.

A brief of Deloitte's 2026 Internal Audit Hot Topics — agentic AI, seven operational priorities, and seven IT/cyber focus areas to have on your radar.

Recent disclosures from Anthropic, OpenAI, and Google reveal distillation attacks at industrial scale. The risk goes well beyond intellectual property.

Distillation attacks let competitors clone proprietary AI models through normal API access. No breach required. Here's how it works.

Part 2 of The Exploitable Mind series. Traditional security training fails because it fights 200,000 years of evolution with a 30-minute PowerPoint. Here’s why awareness alone doesn’t work.

A term called Merkle Tree Certificates is about to start showing up everywhere. Here's what it means and why it matters for your organization.

Authority bias, scarcity, reciprocity, social proof, liking, commitment, loss aversion, cognitive load, pattern recognition, and urgency—the 10 psychological vulnerabilities behind most breaches.

A look at setting up Neovim with LazyVim as a full IDE on Windows, covering the setup process, language support, and day-to-day workflow.

Hard-won advice from multiple PCI DSS Level 1 audits: scope control, QSA dynamics, v4.0 gotchas, and what actually matters in the room.

A finance employee wired $25 million to fraudsters after a video call where everyone, including the CFO, was an AI deepfake. Seeing is no longer believing.

Insider threats cost organizations $17.4 million per year on average. Here is the MICE framework and why human psychology matters more than any firewall.

How to automate a Hugo blog with GitHub Actions, deploy keys, a webhook listener, and nginx — including all the wrong turns.

OpenClaw’s skill files accept natural language commands with no integrity checks — making them a live prompt injection target. Here’s what that means.

Replacing entry-level roles with AI may solve short-term costs, but risks creating a serious skills gap in the IT sector within a decade.