Hacker // Writer // Chronic Thinker
I’ve spent the last 20 years testing systems, leading teams, and figuring out how organizations fail at security.
I’m currently the Head of Offensive Security at Xora (opens in new tab) where I’m working on autonomous source code security engines, conducting vulnerability research, and doing what I can to make AI work for engineers. Before that, I worked red team operations at Bishop Fox (opens in new tab) and spent five years at risk3sixty (opens in new tab), where I led the penetration testing practice.
I publish security writing here and through Empiric Security (opens in new tab), my independent consulting outfit. Outside of work, I shoot film (opens in new tab) and ride motorcycles.
Recent Writing
- Everyone Has A Plan Until They Get Punched In The SonicWall Why any organization with a public IP has to plan for un-patchable zero-day exploitation, not just targeted attacks.
- You Can't Just Publish Partial Exploits Anymore Now published at Xora: taking a 'safely' disclosed WordPress RCE most of the way to a full unauthenticated exploit chain with public research and an LLM.
- One Home for Everything I Write Consolidating my scattered writing under one roof, without giving up digital ownership.
I post new writing here first. Follow a feed to catch it as it goes up. I ♥ RSS (opens in new tab)