Risk is a decision
A rating is an input. Someone with authority chooses, and writes down why.
I am pursuing a master’s in cybersecurity engineering while I work, and I finish in Fall 2027. Ten years of full-stack engineering sit under everything I build, and hands-on AI is part of the work, not a footnote.
Finding signal in noise: detection is a data problem before it is a product.
Attackers are the only honest reviewers of a control. I want to think like one, on purpose.
Where the perimeter used to be, and where policy actually lands today.
Most breaches ship in a commit, so a security program has to start where the code does.
Both sides of the model: what it defends and what it exposes.
The math under the tools, so the claims about them stay honest.
A rating is an input. Someone with authority chooses, and writes down why.
A safeguard people route around is a diagram, not a defense.
One version for the board and one for the operator, and the two must agree.