Well 2025 was a year...

This past year (2025) didn't go the way I expected. With <<gestures vaguely at everything>>, obviously not all of it was great. But some was! And mostly, it was busy. Sometimes we don't end up where we expect When I decided to

False Positive or Noise? Smart security teams still get this wrong

Before you report a security finding as a "false positive", make sure you distinguish between FPs and noise. The difference matters, and more people get it wrong than you'd expect

The MITRE Thing was a wake-up call

MITRE almost lost funding for a big part of the CWE and CVE programs in 2025. That matters, and we need to act even though it worked out this time.

My Setup (because I'm not cool enough to be on Uses This)

I adore the wonderful Uses This (formerly The Setup) series, which has been "[asking] a random selection of people all about the tools and techniques they're using to get things done" since 2009. I'm never going to be cool enough to actually be interviewed

Espresso milk drinks are starting to all be the same

It's fine, really. Really. But I still have Opinions.