SECURITY LEADER · AI-NATIVE SECURITY OPERATIONS · UK

Enrique Cano

I build security teams from scratch and re-platform them for the AI era. The agents, MCP servers and LLM detection pipelines my team runs on in production are code I wrote. Nearly 30 years in engineering and security.

Currently VP of Security, IT and Compliance at Fresha. Previously Cyber Security Architect at General Electric.

01 / what I do

  • AI-native security operations

    Re-platforming security functions so people and AI agents operate them together, through one set of controls, permissions and audit trail.

  • Build and lead security teams

    Starting security functions from nothing and growing them into multi-team organisations that build with AI by default.

  • Security operations and platform defence

    Standing up detection, response and anti-abuse for platforms that are attacked every day, and running them 24×7 with AI in the loop.

  • Security engineering and architecture

    Designing and building the security platforms other engineers build on, and still shipping code, with AI agents as part of the toolchain.

More about my work →

02 / writing

All writing →

Close-up of an old fuse board on a stone wall with a row of white ceramic fuses, one of them missing and bypassed by a loop of twisted copper wire around its two terminals Latest · 28 Sept 2026 · 34 min read Reviewing the code of an AI feature: are the controls really there? How to review the code of a feature that uses an LLM: find its inputs, capabilities and outputs in the code, check that the controls from the threat model are really there, and turn the review into a skill for Claude Code, with the same two examples, a business description generator and a Slack agent that runs commands. Read →
Sept 2026 Threat modelling an AI feature: who else is talking to your model? How to threat model a feature that uses an LLM: map its inputs, capabilities and outputs, ask who controls and who may see each input, and work through the OWASP Top 10 for LLM Applications 2026 with two examples, a business description generator and a Slack agent that runs commands. Sept 2026 Start with the risk: how to prioritise security work Start with the few risks that can really hurt the business, map the controls that reduce them, and use that map to decide what to do first, what to accept and what to tell the board. Jun 2025 Cyber security programs for startups in the AI age What a lone principal security engineer should do in their first three months at a startup, and how AI accelerates each step. May 2025 Revisiting OpenAI Function Calling with Strict JSON Output A walkthrough of function calling with OpenAI’s Responses API and strict JSON schemas, using a timezone converter that tells you the current time anywhere. Covers how the call flows, best practices and the full Python code. Mar 2025 The Pattern Whisperer A cyber thriller in twelve chapters, written by AI from my storyline and plot twist. At 3am in London, a security analyst uses AI to spot an attack no system could see, and finds out he is not the only one who wants what he has built. Novel · 12 chapters Jan 2025 How to use structured output to always return a formatted JSON How to use Pydantic models with OpenAI structured outputs so an LLM always returns JSON in the shape you define, shown with a time-parsing agent. Also covers a simple file-based memory store and exposing the agent through FastAPI. Dec 2024 Building a Multi-Agent System for Incident Response with LLMs Why one incident-response agent isn't enough, and how a coordinator plus specialised agents with their own tools and runbooks handle incidents better. With the full Python code. Dec 2024 The Rise of the AI Sidekick A short piece of fiction set in 2029: a day in the life of a CISO who works alongside AI agents that triage overnight alerts, run threat modelling with developers and handle an incident response.

All writing →