Thought Leadership

Key Takeaways When Anthropic published its piece on recursive self-improvement, the line that traveled was the efficiency one. A 100-person company doing the work of a much larger one, because each person sits atop a pyramid of agents. It's a striking image, and it's probably right. But there's a second diagram hiding inside the first…

Key Takeaways A few weeks ago, Mira Murati's lab, Thinking Machines, put out a research preview of something they're calling interaction models. If you haven't seen it, it's worth your time. This is a serious effort from serious people, the kind of lab that trains a 276-billion-parameter model from scratch and stands up a whole…

Key Takeaways Most organizations believe they have AI governance because they have policies, risk classifications, even responsible AI principles documented and approved. What they do not have, in most cases, is the ability to answer a basic question: what is every AI agent in our environment doing right now, and should it be doing that?…

As a design team, we spend a lot of time watching where users slow down, where they hesitate, and where the product makes them work harder than it should. In cloud security, one pattern shows up again and again: A security engineer starts their day by opening the platform and scanning a long list of…

It’s probably no shocker that most of the code shipping into production this year wasn't written by a person. The real question isn't whether it's any good, but who's watching what it does once it's running, because no human ever held the context for it in the first place. Here's a startling number that may…

TL;DR: API security was designed for a world where APIs were stable, documented endpoints sitting in front of monolithic applications. In cloud-native environments, APIs are dynamic connective tissue between workloads, identities, and data stores and securing them requires runtime visibility across the full cloud stack, not endpoint-level controls alone. Introduction API security has received significant…

Field CISO work is closer to courtship than sales. And what I mean by that is, by the time a CISO has an urgent project, the field of trusted vendors has already been chosen, which means the year before the buying moment is the entire game. The most underused word in cybersecurity is courtship. We…

Key Takeaways We've spent the last decade hardening the perimeter. Using firewalls, Zero Trust and EDR on every endpoint. SOC analysts surviving on cold brew and adrenaline just to keep us safe.  And then GlassWorm walked straight through the front door. Like taking candy from a baby.  If you haven't been following this one, here's…

"You have to map the core logic and syntax of the system before you can find the interesting primitives." This June 1st, Dan Gansel will walk on stage at fwd:cloudsec 2026 in North America to demonstrate a fully functional command-and-control channel that operates inside the AWS Data Perimeter, the cloud-native gold standard for keeping sensitive…

Key Takeaways The single most repeated piece of advice in security leadership is also the one doing the most damage to the profession. Earn your seat at the table. Become a business translator. Integrate into the operator class. The CISOs who follow that advice end up burned out, legally exposed, and stuck in five-jobs-in-one roles…

This week, the Shai-Hulud npm campaign showed how quickly a compromised package can move through the software supply chain, jumping across trusted dependencies and reaching build pipelines before many teams even knew what they were looking at. But this is not just an npm story, and it is not just a story about one campaign.…

One of the most fascinating technologies I've encountered in my personal life over the past few years is autonomous driving. It started as a curiosity, “can my car really drive itself?” Can it actually make decisions with enough necessary context, and not rely solely on static things it sees like trees and roads? Can it…