Field Notes
The part of two decades in security and operations that isn't a control or a cert: how I think about running a program, leading an incident, and making risk decisions a real business can live with. Principles and method, never a client, an employer, a tool, or a number that sits behind an NDA.
Essays
The importance of Why
On working out the why for yourself, the fiction you sometimes build instead, and why a leader hands out the real one.
I Hate Governance
Why the department of no doesn't fly anymore, and what good governance does instead.
Learn AI now
For twenty-three years, every new technology was the same idea in a different coat. AI is the first that made me stop and say wow, and it is already doing my technical work. Why everyone, from engineers to executives, needs to learn it now.
Technology is still magic
I grew up with books, the outdoors, and two fuzzy TV channels, and technology landed like magic. It still does. The wonder that started with one computer is the same engine behind the lab, the certs, and everything else I've taught myself: immerse, attach emotion, and stay curious about how things work.
Burnout is a temperature check
I burn out once or twice a year, and I have for years. I've stopped treating it as a failure and started treating it as what it is: a temperature check and a safety mechanism. Here's the shape it takes, and the only way I know to climb back out.
Listen to your imposter syndrome
Change roles enough times and imposter syndrome stops being an event and becomes the weather. I've learned to treat it as an instrument rather than a verdict: check the work, revisit the hard calls, keep learning. The trick is hearing the right message in it.
The longest drive home
A few years ago, alone in a datacenter at 3am during a core network cutover, I got the call that my last grandparent had passed in the night. There was no one to hand it to and no option but to finish. What I took from the longest drive home of my life.
No plan survives contact
A general and a fighter landed on the same idea: plans break on contact. In a real crisis what matters is not the plan you brought but how fast you build order, decide on incomplete information, and own the call.
Security a 24/7 operation can actually live with
Security leadership is a negotiation with a business that does not stop. A bypassed control is worse than no control.
Running the incident you're accountable for
When you own the incident, your job stops being the forensics and becomes deciding under uncertainty, with the technical recovery and the human one running on two clocks at once.
Playbooks
Building a security program
How I'd build a real security function in an operational business: visibility before controls, a framework as a shared map, and sequencing by risk reduced per unit of effort rather than by what's interesting.
Prioritising controls when you can't do everything
You never have enough time, money, or people, so the whole job is sequencing. A practical, CIS-aligned way to decide what to do first, and what to deliberately leave for later.