The AI You Didn't Approve: A Practitioner's Guide to Shadow AI
Somewhere in your org right now, someone is pasting a spreadsheet into a chatbot you've never heard of. Does that shock you?
I'm a cybersecurity engineer specializing in incident response in healthcare. I focus on the human side of security and work to create security programs that support users. I'm a firm believer that the best security programs are build collaboratively, not just with other IT departments, but with the users we are working to protect.
Practical insights on incident response, security awareness, and the gap between Security Theater and programs that actually work.
Fifteen years in technology, the last five spent entirely focused on cybersecurity — specifically the parts that involve people. I've found that the most effective security improvements don't start with tools. They start with building the right workflows across the right teams and making sure the people inside an organization actually understand why security decisions get made.
All of that work has happened in healthcare, where the consequences of getting it wrong extend beyond data. I've built incident response programs, run tabletop exercises, and sat in the captain's chair when real incidents unfolded. That experience shapes how I think and what I write about.
This blog covers security awareness, incident response program design, and the gap between Security Theater and the things that actually move the needle.
Have a topic you'd like to see covered, a speaking opportunity, or want to connect? Reach out directly.