This is the first post on a blog I’ll use to write up what I’m working on — mostly at the intersection of security engineering and AI.
What to expect
A few themes I keep coming back to:
- Securing AI workflows. How AI tools get attacked in practice — prompt injection, data exfiltration, abuse of agent tooling — and what actually holds up against it.
- AI-native infrastructure. Building the guardrails that let AI tools operate safely inside an enterprise: secure agent integrations (MCP), privacy-preserving telemetry, and AI-driven detection and triage.
- Security automation. Turning manual security operations into API-driven, self-service platforms that cut toil without slowing teams down.
Why bother
The fastest way to lose the security argument is to be the team that says no.
Most of my work is about making the secure path the easy path. I’ll share the patterns that worked, the ones that didn’t, and the occasional war story.
More soon. (This is a seed post — edit or delete src/content/blog/welcome.md.)