Field notes from building enterprise security programs, where reducing material risk is always balanced against the speed of the business. New posts as I publish them.
A first-person account of designing an agent-based approach to security reviews at Databricks. Why the traditional review queue breaks at scale, what an agent can carry, and where human judgment stays load-bearing.
Read on DatabricksThe right answer depends on the company. A control only matters if it meaningfully reduces risk and can be operated at scale, from least privilege and application control to hardening, Linux, and governed exceptions.
Read post