Independent · Since 2013 · No vendor noise
Long-form guides and field notes for the architects and engineering leaders who have to model the threat before an attacker does. Read by practitioners, funded by no one.
STRIDE, attack trees, and the practice of finding weaknesses on paper before an adversary finds them in production.
Trust boundaries, blast-radius containment, and the design decisions that decide how bad a breach gets.
SOC 2, ISO 27001, and turning audit obligations into controls that actually reduce risk.
Telemetry, detection engineering, and shrinking the gap between compromise and containment.
April 24, 2026 · 11 min read
A working architect's view of threat modeling in 2026 — what's changed, what hasn't, which frameworks still earn their keep, and where AI tooling actually helps versus where it's noise.
Read the guide →Threat Modeling
Most framework comparisons read like feature checklists. This one gives working advice: when STRIDE, PASTA, and LINDDUN each earn their place, when they don't, and how to decide without over-thinking it.
July 29, 2026 · 10 min read
Security Architecture
Most architecture review boards become approval bottlenecks that ship rubber stamps. A working ARB is a lightweight decision-forcing function. Here's the difference, and how to run the second kind.
July 27, 2026 · 8 min read
Compliance & Governance
CMMC certification is moving from theory to contract requirement, and most of the defense industrial base is not ready. A working readiness plan, the scoping decisions that decide the cost, and the mistakes that stall a certification.
July 23, 2026 · 12 min read
Security Architecture
The title is fashionable and frequently misapplied. A working look at what an enterprise cybersecurity architect actually does, how people get there, the skills that gate seniority, and how the pay really works.
July 20, 2026 · 9 min read
Enterprise Cybersecurity sits between the research that informs it and the tools it points you toward.
One email, occasionally. Threat modeling notes, security architecture reads, and what's actually working in enterprise programs — no vendor noise.
Newsletter signup is not configured yet.