Security built into the pipeline, not bolted on after the breach.
Security is not a feature you add at the end — it is a property of how you design, build and ship software. The teams that stay out of incident channels bake it into the workflow: threat modeling before code, pipelines that fail closed, and auth that is boring because it is correct. I treat security as an engineering discipline with measurable controls, including in regulated enterprise systems, backed by CSA CCSK and CCZT.
Articles in this hub
13 articles
IntermediatePasskeys vs Passwords: How WebAuthn Actually Works, Who Builds What, and How to Roll It Out
A password is a secret both sides have to keep. A passkey is a key pair only one side ever holds. This is what that actually means at the protocol level — with three diagrams for registration, login and the sync fabrics — plus who ships passkeys today and how to roll them out without breaking account recovery.
Read article
Intermediatenpm Supply Chain Attack Mitigation: What Actually Works
The npm ecosystem changed a lot during 2026. What is now secure by default, what is opt-in and worth turning on this week, and which gaps are still entirely yours to close.
Read article
IntermediateThe Lethal Trifecta: A Practical Test for Prompt Injection Risk
Prompt injection cannot be filtered away. A practical 2026 guide to the lethal trifecta — private data, untrusted content, external communication — how to run it as an audit on your own agents, and which leg is realistic to cut.
Read article
IntermediateWazuh vs Microsoft Sentinel vs Google SecOps: The SIEM You Pick Is the Bill You Get
Three SIEMs, three completely different meters: Sentinel bills the gigabytes you ingest, Google SecOps bills packages with detection-rule limits and will not publish a price, Wazuh bills agents or nothing at all. The model you choose quietly decides what your team is willing to log — and therefore what you can investigate.
Read article
IntermediateIs Keycloak Free? Keycloak vs authentik and What Each Really Costs
Keycloak is Apache 2.0 with no paid tier. authentik is open core — MIT plus a proprietary enterprise directory. That licensing difference matters more than any feature table, and SCIM coverage is not equal either.
Read article
IntermediateOPA vs Kyverno in 2026: Kubernetes Ships Policy Now
Kubernetes now enforces policy in-process: ValidatingAdmissionPolicy went stable in 1.30, MutatingAdmissionPolicy in 1.36. So the real question is no longer OPA or Kyverno — it's what you still need a controller for.
Read article
IntermediateFalco in Production: Runtime Security Without Drowning in Alerts
Installing Falco takes ten minutes. Making it useful takes months. A practical guide to runtime security that survives contact with production — rule maturity, tuning out noise, and what to actually alert on.
Read article
IntermediateTokenization vs Encryption: What Actually Takes Data Out of Scope
"We encrypted everything" does not take a system out of PCI DSS scope, and tokenization does not take you out of GDPR. A practical guide to what each one actually buys you — and where teams get it wrong.
Read article
IntermediateUser-Level Permission Controls for MCP Tool Access with an Enterprise MCP Gateway
MCP gives your AI agents real power — reading files, calling APIs, moving money. But who decides which user or agent can reach which tool? Here is how an enterprise MCP gateway turns that question into a policy you can actually enforce, from the gateway down to every laptop.
Read article
IntermediateBuild Your Own CSPM on GCP: Security Command Center vs Open Source
You do not need a six-figure platform to get Cloud Security Posture Management on GCP. Here is how to build CSPM two ways — the free built-in Security Command Center and a DIY open-source stack — and when each one wins.
Read article
AdvancedKill Your Service Account Keys: Workload Identity Federation on GCP in 2026
Long-lived service account keys are a breach waiting to happen. A hands-on 2026 guide to Workload Identity Federation on GCP: how the keyless token exchange works, wiring GitHub Actions with zero secrets, the attribute-condition trap that opens your project to any repo, and migrating off keys without downtime.
Read article
IntermediateThe First 24 Hours with Security Command Center: What Nobody Tells You
What really happens when you open Google Security Command Center for the first time: 764 findings, single-digit compliance, and a calm plan to fix the right things first.
Read article
IntermediateStop Storing JWTs in LocalStorage: Cookie Auth for SPAs in 2026
A practical 2026 guide to moving JWT authentication out of LocalStorage and into HTTP-only cookies with CSRF protection for SPA, SSR, upload, WebSocket, gateway, and mobile scenarios.
Read article
FAQ
What is your security background?
Are you available to hire?
How do we start working together?
Want security that ships with you?
From auth design to hardened CI/CD and supply-chain defense, I help teams build security into the workflow instead of patching it after an incident.
See security services →