The Human Factor in IAM: Why Identity Programs Succeed or Fail
Most IAM failures don't start with a broken platform. They start with a person making a reasonable decision under bad conditions.
blog
AI Created the Vulnpocalypse. AI Will Also Fix It.
AI has broken traditional vulnerability management by accelerating vulnerability discovery and exploitation, but it may also be the only technology fast enough to help defenders regain the advantage.
Token-Exhaustion Attacks: When Attention Becomes the Target
Token-exhaustion attacks weaponize attention, forcing experts and institutions to spend scarce time, trust and cognitive resources.
Just Risky Enough
We shouldn't be bolting yet more defensive bloat onto a structurally broken ecosystem. We should be fixing the underlying architecture so we can manage risk relative to reward directly.
Anti-Vibe Vibe Coding: Why AI Agents Need the SDLC
AI coding agents make software development faster, but production-ready AI-generated code demands more engineering discipline—not less—from requirements and TDD to security testing, code review, and the SDLC.
Black Hat 2026: AI Security Is Repeating the Cloud Era’s Mistakes
The speed of acceleration has officially crossed out of standard tech cycles and into speculative fiction territory. We are simply out of time to keep making the same predictable, cyclical mistakes and course-correcting after the damage is done.
Still a Cybersecurity Curmudgeon, But Making Better Choices
Jamie Arlen returns to cybersecurity writing with a simple mission: turn hard-earned experience and crankiness into better security choices.
Is it 'Offensive' to be Considered a Governance Vendor?
CTEM, threat intelligence and AI pentesting are converging around one job: finding and prioritizing security risk so organizations know what to fix.
Cybersecurity, Experience and the Risk of Age Bias
Cybersecurity values experience, but age bias in hiring may filter out veteran talent before recruiters ever see it.
How Hacker Summer Camp Mentally Rehydrates Us
Hacker Summer Camp does more than deliver security knowledge. It rebuilds context, connections, and the human judgment AI can't replace.
Hacker Summer Camp Is Missing the Nonprofit Sector
Black Hat, DEF CON, and BSidesLV wrapped up this week. As always, a few security nonprofits found their way into the room. But the sector that runs $1.4 to $1.5 trillion through the U.S. economy every year? Still mostly locked out.
Breaches Don’t Kill Companies. Being Unprepared Does.
From BSidesLV 2026: Adrian Sanabria built "Destroyed By Breach" to cut through cybersecurity myth-making. What he found is more uncomfortable than the fear-driven narrative the industry often sells.
Is Grey Hair the New Gold in Cybersecurity?
The industry treats experience as the ultimate proxy for trust. But in doing so, it's quietly locking out the people it keeps insisting it can't find.
What Security Is For: A Better Way to Measure Success
Black Hat fills the Las Vegas desert with exploits, defenses, products, arguments, and ingenious machinery. Beneath all of it lies a simpler question: what kind of life are we trying to protect?
DDoS Smokescreens Miss the Real Story
DDoS attacks aren't just distractions. Learn why they reshape defender decisions and create opportunities beyond downtime.
Stop Treating Every Human Risk Problem Like a Training Problem
Most security failures aren't training failures. Learn why understanding decision ecosystems leads to better cyber risk outcomes.