Essays

Arguments we are willing to be held to.

Durable positions on where AI security review is heading. Not practical guides. Stances.

Your vendor's review is not your review

When you build a product on a vendor's AI, their security certification covers what they built and how they operate it. The system you built on top of it is not covered. That review is yours to do.

Read

Point of view

The governance layer above the guardrail

A new category of tools enforces security rules inside AI coding assistants. They are solving the right problem second. The source of those rules — a reviewed, approved security model — has to come first.

Read

Point of view

The decision is human

AI can now draft the security review. It can reconstruct architectures, enumerate attack paths, map controls, and grade evidence. Fast, cheap, and at scale. Someone still has to sign it.

Read