2026
- Everyone Has A Plan Until They Get Punched In The SonicWall Why any organization with a public IP has to plan for un-patchable zero-day exploitation, not just targeted attacks.
- You Can’t Just Publish Partial Exploits Anymore Now published at Xora: taking a ‘safely’ disclosed WordPress RCE most of the way to a full unauthenticated exploit chain with public research and an LLM.
- One Home for Everything I Write Consolidating my scattered writing under one roof, without giving up digital ownership.
- What To Do With Bad Ideas From People Who Also Have Good Ideas On consuming valuable ideas from people whose other beliefs you find repugnant, and why avoidance is the choice to be passive.
- Infosec Training Is Weird Now Enshittification comes for us all.
- How to Ensure Your Purple Team Fails Miserably The misaligned incentives, on both the client and consultant sides, that doom most purple team engagements before they start.
- Ocean’s Eleven Heists In a Louvre Four World What real-world heists and insider-threat data reveal about who actually breaks into buildings, and what a physical penetration test is worth.
- How Shadow Incentives Harm Real Security The hidden incentive to make more money, not to reduce risk, that pushes the security industry toward compliance theater.
- You Will Definitely Get Phished, So Stop Simulating It Why phishing simulations punish employees for a problem they can’t solve, and what actually reduces the risk of a successful phish.
2025
- Lessons in Project Management A largely unfiltered and slightly refined response to upper management’s annoying idealisms.
-
Less Pager For Persistence New research for using
lessas a persistence mechanism. ↗ source - Stop Breaking Your Feeds RSS is supposed to be for the readers, not you.
- C2 via Legitimate Services A collection of legitimate services and how to use them for evil.
- Link Blogs A nice way to share without writing an essay.
- Recommended Blogs A collection of blogs/feeds I read on a regular basis.
2023
- Burnout Recovery and Prevention 101 (Part 0) An introduction to burnout and how to recover from it.
2022
- Mastodon, Musk, and Mythbusting: The Case for Federation The old internet was better anyway.
- Secure Messaging for Paranoid Realists: Vol. 2 Reasons for not using Conduit anymore.
- Learn Exploit Development for Free A free guide to free resources for learning exploit development.
- Secure Messaging for Paranoid Realists …like me.