Security systems / investigate and verify
Application and AI Security
Examine the boundaries. Verify the defenses.
I explore application and AI security through trust-boundary analysis, secure design, and reproducible experiments. My engineering background connects security decisions to the systems people build and use.
Application security and engineering leadership
Engineering Manager at Brivo, with 25+ years in software engineering. Application security, secure design, and trust-boundary analysis connect my research to hands-on engineering.
Interested in conversations about application security, AI security, and reliable engineering. Remote US.
Current Position
Current Focus
Now
Updated October 2026
- Engineering Manager at Brivo, with a hands-on background across mobile, web, cloud, and connected systems.
- Exploring application security, trust boundaries, and the OWASP LLM Top 10 through public lab work.
- Documenting experimental limits and verifying defenses on controlled synthetic fixtures.
Active Mission Board
Selected Work
Investigate, measure, explainSecurity practice and public research
Threat modeling, secure code review, and controlled experiments make assumptions and failure modes visible.
Threat modeling, secure code review, and application-layer testing inform architecture and delivery.
Engineering practice02 / ResearchAI Security LabInvestigate agent failure modesAn isolated OWASP LLM Top 10 lab with synthetic fixtures, attacker payloads, and explicit experimental limits.
Public research03 / ExplainTalk and WritingShare the experiments and their limitsPublic security articles and the Breaking Agents talk connect demonstrations to practical engineering questions.
Public materialCurrent Trajectory
Current Focus
Exploring the OWASP LLM Top 10
The public AI security lab explores vulnerable agents and defenses using synthetic fixtures. The deterministic RAG demonstration illustrates an attack path; it does not measure production-model resistance.
Hull Integrity
Experimental Limits
Evidence before confidence.
Keep targets isolated, state assumptions, and distinguish a reproducible demonstration from a production security claim.
Latest Transmissions
Latest Writing
Security research and field notes
A hands-on RAG prompt-injection lab for learning OWASP LLM01:2025, measuring attack success rate, and testing a simple spotlighting defense.
Project noteSupply Chain Attacks on AI Tooling: Lessons from Shai-HuludA field report on the npm worm that targeted ~/.claude/, the three scanners I built in response, and what AI infra security needs next.
Project noteWelcomeWhat this site is and what's coming.