Lessons from the work. Fractional technology leadership, security programs, and Azure architecture for small companies that need senior technical ownership.
I was promoted from senior developer to VP in 2004 and couldn't stop writing code. What a founder should check before promoting their strongest engineer, and what real support looks like.
Read post →An enterprise customer sent a security questionnaire titled for AI-accelerated attacks. Four of its eighteen questions were about AI. The rest were the security program I already had, with a new reason attached.
Read post →I built a live multi-tenant SaaS product with AI coding agents and never wrote a line of it. Why nothing broke, and why the real risk with AI-written code is the code that runs clean and is quietly wrong.
Read post →Every SaaS company selling to enterprise hits the security questionnaire wall, again and again. A practitioner take on why the questions keep coming and how to stop answering each one from scratch.
Read post →AI isn't a new category of risk. It's a new vector for existing ones. How to govern AI tools by extending the security program you already have, before the customer questionnaire arrives.
Read post →Twelve months of preparation, a four-terabyte database, and a single maintenance window. The decisions that made an Azure migration uneventful, and the ones I'd revisit today.
Read post →Most companies reach for a CTO when something breaks, but the role is a bundle of jobs that can be filled by a combination of people. A founder's guide to asking a better question.
Read post →A practitioner's account of building a SOC 2-ready information security program from nothing, and sustaining four consecutive SOC 2 audits with zero findings, three of them Type 2.
Read post →A guide for business leaders who need senior technology leadership without a full-time executive hire. What the role really involves, and what it doesn't.
Read post →