Writing

Sept 2026 Reviewing the code of an AI feature: are the controls really there? How to review the code of a feature that uses an LLM: find its inputs, capabilities and outputs in the code, check that the controls from the threat model are really there, and turn the review into a skill for Claude Code, with the same two examples, a business description generator and a Slack agent that runs commands. Sept 2026 Threat modelling an AI feature: who else is talking to your model? How to threat model a feature that uses an LLM: map its inputs, capabilities and outputs, ask who controls and who may see each input, and work through the OWASP Top 10 for LLM Applications 2026 with two examples, a business description generator and a Slack agent that runs commands. Sept 2026 Start with the risk: how to prioritise security work Start with the few risks that can really hurt the business, map the controls that reduce them, and use that map to decide what to do first, what to accept and what to tell the board. Jun 2025 Cyber security programs for startups in the AI age What a lone principal security engineer should do in their first three months at a startup, and how AI accelerates each step. May 2025 Revisiting OpenAI Function Calling with Strict JSON Output A walkthrough of function calling with OpenAI’s Responses API and strict JSON schemas, using a timezone converter that tells you the current time anywhere. Covers how the call flows, best practices and the full Python code. Mar 2025 The Pattern Whisperer A cyber thriller in twelve chapters, written by AI from my storyline and plot twist. At 3am in London, a security analyst uses AI to spot an attack no system could see, and finds out he is not the only one who wants what he has built. Novel · 12 chapters Jan 2025 How to use structured output to always return a formatted JSON How to use Pydantic models with OpenAI structured outputs so an LLM always returns JSON in the shape you define, shown with a time-parsing agent. Also covers a simple file-based memory store and exposing the agent through FastAPI. Dec 2024 Building a Multi-Agent System for Incident Response with LLMs Why one incident-response agent isn't enough, and how a coordinator plus specialised agents with their own tools and runbooks handle incidents better. With the full Python code. Dec 2024 The Rise of the AI Sidekick A short piece of fiction set in 2029: a day in the life of a CISO who works alongside AI agents that triage overnight alerts, run threat modelling with developers and handle an incident response. Dec 2024 Building A WAF Query Agent To Analyse WAF Logs Using GPT-4o-mini A command-line agent that turns plain-English questions about AWS WAF logs into Python code with GPT-4o-mini and runs it locally in a restricted sandbox, so only the log schema leaves your machine. Covers the architecture, safe code execution, query history and pagination. Dec 2024 Building a Natural Language Interface for Shodan’s InternetDB API A Python natural language interface that uses an OpenAI model to query Shodan’s InternetDB API about IPs and ranges, and how rewriting the system prompt turned verbose step-by-step narration into concise security findings. With the code and before-and-after outputs. Dec 2024 API-as-an-AI-Agent: A Fresh Take on API Integration using AI Agents A thought experiment on wrapping each API endpoint in an AI agent that turns natural-language requests into API calls: the pros and cons, whether such agents could be generated from documentation, and patterns for coordinating them. Nov 2024 Building a Multi-Agent AI System From Scratch How to build a multi-agent AI system on the UNIX “do one thing well” principle, with a coordinator routing security incidents to specialised Account Takeover and Phishing agents. Includes the full Python code and a sample run. Nov 2024 How I Built a Context-Aware Slack Bot with LLM Powers: Meet HAL An overview of the architecture behind HAL, a Slack bot that keeps whole-thread context: a Lambda function calling an LLM, conversation history in PostgreSQL, and secrets in Parameter Store inside a private VPC on AWS. Nov 2024 Threat Modelling Using GenAI: Comparing 6 Different Models Six GenAI models (gpt-4o, o1-preview, o1-mini, Claude 3.5 Sonnet, DeepSeek and Mistral) threat-model the same e-commerce login screen from one simple prompt, scored on framework, completeness, attack vectors, mitigations, clarity and actionability. Includes the full output of the two top-scoring models. Nov 2024 The Rise of Hybrid SOC Teams: How LLMs and AI Agents Will Redefine Cybersecurity Operations Where LLMs fit in a Security Operations Centre today, and why the SOC of the future will be a hybrid team of people and AI agents working together through chat, meetings and voice. Nov 2024 Getting Started with AWS Bedrock and Claude 3.5 Sonnet v2: A Step-by-Step Guide in Python A short walkthrough for calling Claude 3.5 Sonnet v2 on AWS Bedrock from Python with boto3: enabling model access, setting up the environment, and sending a system prompt, text and an image through the Converse API. Nov 2024 From Directed to Autonomous: A Framework for Applying GenAI in Security Operations — Level 1: Directed Security Operations What Directed AI operations are, where AI follows human direction on repetitive security tasks, and why they suit SMBs. Includes a Python example that uses OpenAI’s API to generate AWS WAF rules from a plain-language description. Nov 2024 From Directed to Autonomous: A Framework for Applying GenAI in Security Operations A three-level framework, Directed, Supervised and Autonomous, for how small and medium businesses can apply generative AI to security operations, with typical use cases for each level.