Field notes · about twice a week
I write about the state of modern IT and security.
New to security? Start with the simple version.
An AI feature is assembled from parts other people made: a hosted model, downloaded weights, editor plugins, tool servers and SaaS connectors. Each is a supplier with access, and the incidents of the last two years came through exactly those parts. Most third-party registers list only the first.
DNSSEC lets a resolver check that a DNS answer really came from the owner of the name. It was built to stop forged answers, it is switched on far more by resolvers than by domain owners, and when it fails it takes whole domains, and once a whole country's zone, offline.
Email still runs on a 1980s protocol that lets any server claim to be anyone and send in the clear. Opportunistic TLS, SPF, DKIM and DMARC were added on top, one problem at a time. Each fixes something real, each breaks something else, and none of them stops a lookalike domain.
Jev is a new kind of AI model that writes no text. It reads something and answers typed questions with a choice, a score or a yes/no probability, in a fraction of a second and for a fraction of a cent. That makes it a good first sorter for alerts, data labels and agent actions, and a poor final judge.
Large language models now come in four kinds, not one: frontier models for the hardest work, workhorses for most of it, small fast models for volume, and open-weight models you run yourself. The names change every month and the kinds do not, so choose by job, test one size down, and write policy about kinds rather than names.
Both rows use a log scale: every tick is ten times closer to today.
Most organisations are not at one stage: they run a mix, with older patterns still protecting parts of the estate. Years mark roughly when each idea took hold, not when it disappeared. Human dates are rounded from the fossil and archaeological record, and the figures are the familiar "march of progress" picture, used loosely. An independent synthesis for architecture discussion.
Each field note is published to one topic. Follow a topic to see it first.
Security architecture has moved from walls to identity to a shared fabric of controls, and is now moving towards systems that sense and act on risk by themselves.
3 field notesIdentity has become the control point: access is decided by who or what is asking, not where it sits.
4 field notesSegmentation limits how far an intruder can travel, but it stalls when nobody can say what a workload is.
5 field notesThe shift is from counting vulnerabilities to managing exposure: which weaknesses can actually be reached and used, on the things the business cares about.
1 field noteData protection means knowing where sensitive data lives, how it moves and who can take it, then stopping loss without stopping work.
1 field noteCloud security is decided mostly by how platforms are built and run, and less by the tools bolted on afterwards.
1 field noteAI touches security twice: as a system to be secured, with new data, supply chain and agent risks, and as a tool for defenders and attackers alike.
4 field notesRegulators now ask whether important services can keep running through disruption, including disruption at suppliers, and not only whether controls exist.
1 field noteEach project has its own section of this site.
Continuous Threat Exposure Management, and a capability self-assessment.
Simulate Illumio labels and their segmentation impact: blast radius, labelling demo and the web app.
A vendor-neutral Data Loss Prevention framework, explored through six views.
The proxy for people and the proxy for applications, kept distinct from DLP, with components, flows and framework references.