4 min read
SKILL.md Is the New package.json — Treat Your Skill Library Like the Supply Chain It Is
Agent skills are unsigned, executable third-party code — a supply chain most teams install on vibes. How to govern your skill library like one.
Blog
Thoughts on safe autonomy, engineering automation, and reducing cognitive overhead without putting your systems at risk.
7 min read
The Tuesday Briefing — Jul 14, 2026
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
6 min read
The 12-Factor Agent's Missing Factor Is Security
The 12-factor-agents spec never says security out loud — yet owning your context window is DLP, a structured tool schema is your authorization point, and a human-contact tool call is your approval gate. Reliability and security are the same seams read twice.
6 min read
The Tuesday Briefing — Jul 7, 2026
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
5 min read
Skill Was Never the Threat — Scaffolding Is
Everyone is auditing the model. The real attack surface is the harness you wrap around it — the scaffolding that wires tools, memory, and control flow into an agent that can actually act.
9 min read
The Tuesday Briefing — Jun 30, 2026
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
5 min read
Finding Bugs Got Cheap — Trusting the Fix Is the New Hard Part
Anthropic just open-sourced its AI "defender's loop." The real lesson isn't about C code — it's that the bottleneck moved from finding vulnerabilities to trusting what your agents tell you, and that's a governance problem you own.
8 min read
The Tuesday Briefing — Jun 23, 2026
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
7 min read
The 97% Number: What Happened When We Automated Security Triage
We automated security alert triage to a 97% noise-reduction rate — then a suppression rule went stale and nearly let a production vulnerability through unnoticed.
6 min read
The Tuesday Briefing — Apr 21, 2026
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
7 min read
Why We Failed Our Agent-Readiness Audit on Purpose
An automated audit gave us nine recommendations for being 'agent-ready.' We shipped three and deliberately failed the other six — because a security firm's agent-readiness is measured by signal honesty, not checkbox coverage.
8 min read
The Tuesday Briefing — Apr 14, 2026
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.