Instrumentation Inherits Its Author's Blindspots
Self-instrumented systems are blind in a direction you can predict from who wrote the logging. Why standard telemetry misses attacker behavior, and how to log the application's assumptions and threat model to get the second reading.
Recent posts
View all →-
From Threshold Alerts to Information-Theoretic Stability: Quantifying Behavioral Drift
Alert volume is the wrong thing to measure. Using information-theoretic divergence (Jensen-Shannon, KL) to quantify behavioral drift, and turn vulnerability management into continuous behavioral integrity.
-
From the Louvre to AFCON: A Structural Pattern
The Louvre ticket-fraud ring and AFCON 2025 scalping look unrelated, but they share a structure: when access isn't bound to verified identity, it becomes currency. A look at the wider MEA fraud economy.
-
The Day I Could Not Buy Lunch
A first-person account of the April 2025 Iberian Peninsula blackout, and what ten hours without power or connectivity reveal about how completely modern life now depends on systems we don't control.
-
Identity Isn't a Component of Security. It Is Security.
Identity has become the most fragile, least-governed layer of the enterprise. Why privilege sprawl and fragmented trust, not insufficient technology, drive modern breaches, and what actually reduces the risk.