Blog
The Blog Watches the Watchers: Building a Threat-Intel Page With No Servers
7/26/2026
I wanted a live security-feeds page (CISA KEV, fresh CVEs, AI security research) on a static blog with no backend. Here's how it works, and why the hardest part was trusting nothing.
When the Pentester Is the Model: What the OpenAI and Hugging Face Breach Confirms
7/23/2026
A cyber-capability evaluation escaped its sandbox and breached a real company. It is not a new attack so much as a live proof of three things this blog keeps arguing: the lethal trifecta, machine identity, and ungoverned agents.
Paste Once, Lose Everything: What ClickLock Teaches About Trusting Your Own Terminal
7/21/2026
A new macOS stealer doesn't exploit a bug: it exploits a habit. ClickLock coerces victims into typing their own password by making the Mac unusable until they comply. Here's the anatomy, and why the scariest attacks need no exploit at all.
I Made Claude Bet the World Cup (With Fake Money), and It Taught Better Risk Lessons Than Most Security Training
7/15/2026
Before the 2026 semifinals, I asked Claude for calibrated predictions and a stake-sizing plan. The AI's most rational recommendation? Barely bet at all. Here's what a football tournament teaches about probability, calibration, and the scams riding the hype.
A DLP Baseline for Small Teams: Stopping Leaks Without a SOC
7/12/2026
Data-loss prevention is usually sold as enterprise tooling. Here's a pragmatic baseline a small team can actually run, built on classification, identity, and a few high-leverage controls.
Threat-Modelling Your First MCP Server: STRIDE for the Agent Era
7/3/2026
MCP servers hand an AI agent real tools and real access. Here's how to run a classic STRIDE threat model over one before you wire it to anything that matters.
Machine Identity Is the New Perimeter
6/17/2026
Human logins are well defended. The unguarded door now is the service account, the API key, and the AI agent. A baseline for treating non-human identities as first-class.
PCI DSS 4.0, Part 2: How the 12 Requirements Ladder Up to 6 Goals
6/13/2026
A practitioner's map of PCI DSS 4.0: the 6 control objectives, the 12 requirements beneath them, and how to read the standard as a security model rather than a checklist.
Building Sakinah: An App for the Hardest Moment
6/8/2026
I built Sakinah to help Muslim families in Singapore through the hours after a death. The decisions I'm surest about weren't features: they were the things I chose not to build, hold, or collect.
Governing AI Agents: When the User Isn't a Person Anymore
6/8/2026
Agentic AI breaks the assumption that every action traces back to a human. Here's a baseline for giving agents identity, scope, and accountability.
Learning Log: PCI DSS 4.0 Fundamentals
9/7/2025
Notes from my deep dive into PCI DSS 4.0 fundamentals, with a plan for my next stage of study.
Why Side Quests?
9/7/2025
A space for the random challenges, experiments, and reflections that don’t fit neatly into my main work.
The Lethal Trifecta: Setting Secure AI Baselines for Organisations
9/1/2025
Simon Willison’s ‘lethal trifecta’ and how to turn it into an enterprise baseline.
Learning Log: Terminal & Plugin Setup Journey
8/24/2025
Customising my Zsh environment with Powerlevel10k, fzf, zsh-autosuggestions, and zsh-z: lessons learned along the way.
Week 34: Notes
8/23/2025