The Security Brutalist.

I'm a security professional with over 25 years of experience across nearly every area of the field. My work centers on two connected ideas: security brutalism, a stripped-down approach built on four disciplines instead of forty tools, and security unconventional warfare, where small specialized teams hunt reconnaissance and close attack paths before an adversary can use them.

Both grew out of the same observation, that architecture, controls, and reports often diverge from what is actually happening on the ground, and that compromise is always possible no matter how much effort goes into prevention. That observation led me to security survivability engineering, the discipline of designing systems that keep functioning, absorb damage, and recover fast when something gets through, measured by how quickly a system exits a failed state rather than by how many attacks it prevents.

Currently, I'm focused on making security clearer for C-level and Board audiences. That work led me to create Brutalist CISO Notes, a way of writing notes for CISOs. Check them out.