My career started in the early 1990s; back then, security was barely a thing. Because of the nature of the work I have done for the last 3 decades, I want to be very clear:

I cannot and will NEVER share specifics about any former clients or employers.

Occasionally I may make observations on the software industry, the cybersecurity industry or the types of people I have encountered in my career. I might write something like “I did the Y2K audit for Charles Schwab” or “I did the first pentest of Twitter,” but I will never provide any details that could be risky.

This is also true when I write about individuals. I may write about how some folks sort into categories of actors or make observations about legibile vs. illegible or integrative vs. distributive bargaining, but I won’t name names. Anyone reading what I write who feels seen, that’s on you fam.

When you’ve been carried along by a raging torrent of chaos pudding as long as I have, thinking in abstractions is a survival skill.