AI Is Not Software. It's Another Intern.
Your model didn't fail you. Your specs did.
Black October: Take the Black Monday Advice
Suppose I told you, before the crash, exactly how the market would fall and exactly how bad it would get. Then Black Monday arrived and it went the way I said.
It's Not the Helicopter's Fault
Your agents didn't fail. Your organization did, in the same five places it was already failing.
Replaceable Is a Boolean. Fungible Is a Measurement.
Disclosure: I use Claude every day. This piece is not about Anthropic being risky.
Tech Has No Coast Guard
Two AI-adjacent supply chain breaches in three days. Both targeted developer tooling credentials.
The Boxes The Budget Built
The casting call is already going out. Lapsus$ posted Mercor on its leak site on April 4 with 4 terabytes of contractor onboarding data, and somebody is going to play the security leader who walks out of HR with a banker's box.
The CVE You Can't Patch
On Wednesday, Microsoft disclosed CVE-2026-69836, an unauthenticated remote code execution flaw in Entra ID with a CVSS score of 10.0. Exploited in the wild.
The HOA Has Been Sending You Letters for Years
On August 18, the NSA, CISA, the FBI, the Department of Energy, and the EPA put their names on the same document. Five agencies.
The Token Cap Is Not a Strategy
What Uber's AI budget actually tells you, and why the fix everyone applauded is the wrong one.
You Bought Temu Cybersecurity
I've been told no on a patch window more times than I can count. The answers are always reasonable, and they're always some version of the same thing.
You Can Build It. That Was Never the Question.
Thirty-two percent of organizations decided against buying at least one software product or feature this year because they believed they could build it in house with agentic coding tools. That's from McKinsey's 2026 State of AI survey, which also found large enterprises scaling AI agents jumped from
You Can't Eat the Sacred Cow
We love telling each other not to eat the elephant all at once. Good advice, mostly useless, because it assumes you're allowed to take a bite.
You Said No Hitting, So I Kicked Instead
A ransomware operator spent six weeks this spring running Cursor's AI agent inside other people's networks. Ten targets between April 8 and May 21.
Is Now the Age of the Generalist?
When AI makes every answer nearly free, the scarce skill becomes knowing which question to ask first.
The Code Is the New Data. Nobody Is Recovering It Right.
Your backup strategy almost certainly doesn't cover what your AI coding tools are doing in your repos.
Your Partner Is Running the Play. Are You Sure They Know the Playbook?
When a partner shows up with a maturity assessment, every answer maps to what they sell.
AI Is a Hacker Superpower. Your Recovery Strategy Is Not Ready.
If AI makes attackers faster and more adaptive, your ability to recover matters more than your ability to prevent.
Backup Is Bullshit. Recovery Is Everything.
We built an entire industry around the wrong word.
Immutability Has an Expiration Date
Immutability is a property of the data. It says nothing about the system that holds it.
Trust Is a Contract. Where's Yours?
When a vendor says data trust, ask them to define it in writing or treat the term as marketing.
Your Identity Was Compromised. The Question Is When.
If ransomware hit you, your identity system was serving the attacker long before the ransom note.
Why Your Intelligence Function Will Fail Faster Than Ever
AI captures the polite nod with perfect fidelity, and a polite nod is not signal.
Stop Debating Mythos. Start Defending Against It.
Whether the dangerous model is real or a hoax, the work in front of you is identical, so do it before you become a headline.
AI Amplifies Everything. Including Your Bad Security.
AI doesn't change which drivers are bad. It hands them faster cars and takes the governor off.
The NVD Isn't Under-Funded. It's a Broken System.
The world let one US federal agency hold infrastructure critical to the entire internet and never planned for the day the politics moved.
The AI Penalty Box
Gartner isn't measuring agentic AI, it's measuring what most CIOs are doing wrong.
Your AI Agents Aren't NHIs. They're NDIs. And We Did This to Ourselves.
An AI agent is a new category of principal, and naming it wrong is how you govern it wrong.
The 29% Aren't Sabotaging Your AI. Your Program Has No Clothes.
The survey said the workers were sabotaging AI. It also said the executives knew the program was theater. Read the numbers together.
The Top Three Beats the Top Ten Thousand
Exposure management only works when you respect the people who actually fix things.
Production Avoidance Is Killing Your AI Strategy
Your pilot didn't fail. You don't know how to operate it, so it never shipped.
Replaceability Is the Most Important Thing You're Not Designing For
In a market where models change weekly and prices change monthly, the cheapest insurance you can buy is the ability to swap any component out.
Stop Counting Blinks
Saving a thousand people five minutes a day saves nothing you can measure or defend.
The Determinism Trap
Your AI gives the same wrong answer every time because you engineered the reasoning out of it.
The Governance Bill Comes Due
Your chatbot is ordering Big Macs and writing Python, and nobody owns the part of the program that was supposed to stop it.
It's Always DNS. NIST Finally Agrees. The Vendors Heard Something Else.
NIST finally treats DNS as a control surface and the marketing machine instantly turned a measured reframe into a seven-figure religion.
Block the AI Browsers
AI interprets everything as potential instruction, and that is exactly what an attacker needs.
CISO Liability: Six Traps That Destroy Security Leaders
CISOs don't fall because of the breach. They fall because of what they said about it, and what they never wrote down.
CISO Liability: The First Head on a Pike That Wasn't
The SEC dropping the SolarWinds case against its CISO wasn't a victory for security leaders. It was a warning.
CISO Liability: Your Survival Contract
Competence protects the company. Contracts protect you. Build the survival contract before the breach, not after.
DataOps Isn't Real
Anything with "Ops" in the name needs an operating model to be real, and DataOps doesn't have one.
The Evolution of Identity: How Shadow IT Became Shadow AI
Your access model was built for static, human identity, and that assumption is now dangerously wrong.
Stop Boiling the Ocean
Fix the data your next AI use case needs, learn what it teaches you, and let the business decide where to invest from there.
Stop Doing Everything, Start Doing What Matters
Security is not about doing everything, it is about doing the right things well.
Storage Companies Playing Dress-Up
Calling yourself AI infrastructure because you store the data AI uses is like calling yourself a chef because you own a refrigerator.
The 128-Bit Reality
Most companies selling post-quantum encryption are selling fear of a future problem to fund their present valuations.
The Agentic AI Pretenders
2026 is the year the market finally learns to tell the experts from the snake oil.
The Curiosity Test
The only employee metric that matters in an AI world is the one your competency frameworks don't measure.
The Integrated Stack Trap
Why fungibility beats convergence in 2026.
The Layoff Excuse
AI is not the reason companies are cutting headcount, it is the cover story they were waiting for.
The Supply Chain Crisis Nobody's Preparing For
SOC 2 certifies that a vendor can run code securely. It says nothing about whether the code is secure.
Who Owns Your Face?
Identity ownership is the defining battle of 2026 and almost nobody is talking about who actually owns the thing being faked.
The FCC Just Made America Less Safe
Rolling back telco cybersecurity rules after the largest telecom breach in history is regulatory capture in its purest form.
CTEM, Breaking Through the Hype
Continuous Threat Exposure Management offers real value, but only if you cut through the marketing and demand proof.
The EU AI Act. This Is Why We Can't Have Nice Things
The bad actors made AI feel invasive, and now everyone operates under stricter rules.
Apple's AI Privacy Strategy
Privacy as a fundamental human right is not a constraint on AI innovation, it's a competitive moat.