Now

Updated September 2026

• Preparing to present Beyond the Pipe at IEEE ISC2 in late October.
• Building this site and starting to write in public.

Ideas I keep coming back to

1. Most serious failures come from known risks that were ranked wrong, not from risks nobody saw.
2. Risk assessments end at the edge of one organization. Failures don't.
3. A vulnerability that nobody owns after it's found is almost as dangerous as one nobody found.