Inside the Threat

I didn’t set out to write a cybersecurity book. I wanted to write down the things I wish someone had told me at a few moments in my career when the answer wasn’t obvious, the clock was running, and a decision still had to be made.

Over fifteen years, the technology kept changing. I worked around public infrastructure, watched enterprise software move into the cloud, spent years inside cloud security, built security programs, and eventually found myself on the other side of the table, evaluating the technologies and teams shaping what comes next. Each move changed the way I thought about security. But the same lesson kept showing up.

Most organizations don’t get into trouble because they forgot to write a policy. They get into trouble because the system they think they have and the system they actually have are two different things.

*Inside the Threat* is about that gap.

It’s about the customer question that suddenly stops a deal. The permission that made sense two years ago and nobody remembered to remove. The dependency everyone trusts because nobody has looked at it closely. The AI agent that quietly accumulates more authority than anyone intended. And the uncomfortable questions that are much cheaper to ask before something goes wrong.

This isn’t a book about perfect security. I don’t think that exists.

It’s about seeing your environment clearly, making better decisions when the answer is incomplete, and building an organization that can move quickly without becoming fragile.

Move at the speed of business. Keep the rigor anyway.