AI, Business

Why Claude’s Code Security Offering Doesn’t Replace Real SMB Cybersecurity

There’s been a lot of noise lately about AI (=Claude Code Security) replacing large chunks of cybersecurity.

Let’s slow down and separate what AI is actually good at from what actually keeps small and mid-sized businesses safe.

AI tools that scan code?
Impressive.

AI that reads configs and flags obvious misconfigurations?
Useful.

AI that can reason over static artifacts and suggest fixes?
Absolutely real progress.

But here’s the uncomfortable truth: most SMBs are not losing sleep over static code scanning.

They’re losing sleep over this:

  • “Why did our Microsoft 365 tenant just send 8,000 phishing emails?”
  • “Why is our bookkeeper’s laptop beaconing to an IP in Eastern Europe?”
  • “Why did our backup silently fail for 12 days?”
  • “Why did we pass compliance last quarter and now suddenly we don’t?”

That’s where EspressoLabs lives.

LLMs are extraordinary pattern recognizers.
They are very good at analyzing text, code, logs — when you give them the data in a clean, structured way. But SMB security isn’t clean. It’s messy, inconsistent, human, political, and operational.

EspressoLabs provides value in places LLMs simply cannot operate — at least not yet:

Continue reading →
Standard
Business, webdev

Stay Ahead of Cyber Threats with CISA Advisory Monitor

Here’s a boring truth:
Cybersecurity and Infrastructure Security Agency publishes critical cybersecurity advisories.

Here’s a less comfortable truth:
Most teams never check them.

CISA maintains the Known Exploited Vulnerabilities (KEV) catalog. These are not “theoretical risk under certain lab conditions” bugs. These are vulnerabilities attackers are actively exploiting in the wild, right now, against real systems.

When something lands in KEV, it’s not a polite suggestion. It’s a flare in the sky that says: patch this, or prepare for visitors.

And yet—no one wakes up thinking, “Before coffee, let me refresh a federal website.”

We’re building product.
We’re shipping features.
We’re arguing in Slack.
We’re trying to remember where that one Terraform variable is defined.

So I built a bot that does the refreshing for us.

Continue reading →
Standard
AI, bots

Leveraging OpenClaw as a Web Developer

This post is a sort of TL;DR about OpenClaw –> What it is, why it matters, and how to integrate it into real workflows

OpenClaw is an open-source AI agent framework that enables you to build conversational and automated systems running on your own infrastructure. Unlike typical “chatbot SDKs,” OpenClaw turns large language models into agents that do real work — handling messages, executing workflows, and integrating with tools and APIs.

For web developers, this opens up a new category of integrations: intelligent assistants embedded into your app, autonomous workflows triggered via REST or webhooks, and programmable bots that connect multiple systems.

“with great power comes great responsibility”

What OpenClaw Actually Is

At its core, OpenClaw consists of these components:

  • Agent Core – orchestrates conversation state and skill invocation.
  • Channels – adapters that connect your agent to messaging platforms (Telegram, WhatsApp, Slack, SMS, browser UIs, REST endpoints).
  • Skill Engine – modular plugins that define actionable logic (e.g. work in your browser with your permissions, read email, fetch data, run a workflow).
  • Sandbox – a safe execution environment for custom code. Start with it and move slowly to allow it more permissions (OpenClaw)

Importantly for developers: OpenClaw is model-agnostic — you choose the LLM provider (OpenAI, Claude, or self-hosted models). It’s also fully open source (MIT), so you can extend and embed it in your deployments without vendor lock-in.

Continue reading →
Standard
Business

CMMC Compliance: Why It Matters for Your Business

It’s not easy early in the morning… but let’s talk about CMMC.

If you work with the Department of Defense—or want to—you’ve probably had one of these moments:

  • “Wait, we need how many controls?”
  • “Is this just NIST 800-171 with extra paperwork?”
  • “Can’t we just say we’re secure?”

Short answer: no.
Long answer: definitely no.

What CMMC Really Is (Without the Buzzwords)

CMMC (Cybersecurity Maturity Model Certification) is the DoD’s way of saying:

“If you want access to our contracts, prove you can protect Controlled Unclassified Information (CUI).”

It formalizes what many companies should have been doing already:

  • Enforcing strong access controls
  • Logging and monitoring activity
  • Managing vulnerabilities
  • Hardening endpoints
  • Applying real security policies (not just a PDF in SharePoint)

In other words: operational cybersecurity, not theoretical cybersecurity.

Continue reading →
Standard
Business

Automate Your Trading: Lessons from Software Engineering

My inbox is FULL. Always.
GitHub PR approvals.
Google Cloud alerts screaming about latency.
And—wedged right in between—execution reports from a few brokers politely informing me I did something… emotional.

For years I treated these worlds as unrelated.
Coding was the rational, well-lit part of my brain.
Trading was the fun, dopamine-fueled corner where rules were optional.
That worked right up until a few “strong conviction” trades turned into a full-blown kernel panic in my P&L.

That’s when it clicked:

An options portfolio is just a distributed system with terrible documentation and hostile users.

If you wouldn’t run a production service on vibes, why are you running your money that way?

Continue reading →
Standard
life, Sport

Optimize Your Murph Challenge Experience with This Tracker

The Murph Challenge isn’t a workout.
It’s a systems failure conducted at heart-rate redline.

If you’ve ever tried to remember whether you’re on rep 183 or 193 of squats while your lungs are filing a formal complaint, you already know: human memory is not a reliable datastore under load.

So I built a Murph tracker that does exactly one job well—count reps—while I focus on the important things, like not dying.

🎖️ What is Murph (and why people keep doing it)

The Murph Challenge is performed on Memorial Day to honor Lt. Michael P. Murphy, a Navy SEAL killed in Afghanistan in 2005.

It was his favorite workout. Originally named “Body Armor”, which feels accurate in the same way “production incident” feels accurate.

The canonical version:

  • 1 mile run
  • 100 pull-ups
  • 200 push-ups
  • 300 squats
  • 1 mile run

Optional difficulty modifier: wear a 20 lb vest and rethink your life choices.

Continue reading →
Standard
AI, Business

How AI is Reshaping Engineering Roles

Every few weeks there’s a new take declaring that AI has made junior engineers obsolete, senior engineers redundant, and teams magically “10x.”
That story is lazy.
And dangerous.

AI didn’t remove the need for engineers. It exposed which parts of engineering were never that valuable to begin with.

What’s actually happening is a compression of execution. The typing, scaffolding, and boilerplate are cheaper than ever. Judgment, architecture, and responsibility are not. If anything, they’re more expensive—because the blast radius is larger.

This forces a reset. On roles. On metrics. On how we train people. On what “good” looks like.

Let’s talk about what to do.

For Engineering Leaders (CTOs, VPs, EMs)

Redesign junior roles instead of killing them

If your juniors were hired to crank out CRUD and Stack Overflow glue, yes—AI just ate their lunch.

That’s your fault, not theirs.

Stop hiring “Keyboard Cowboys” –> Hire juniors who can:

  • Drive AI tools deliberately
  • Reason about outputs
  • Write tests that catch subtle failures
  • Explain tradeoffs in plain language

Make AI usage explicit in job descriptions and interviews. Ask candidates how they validate AI output, not how they prompt it. The junior of the future is an operator and a critic, not a typist.

Make fundamentals non-negotiable

AI is great at producing answers.
It’s bad at knowing when they’re wrong.

Your review culture must check understanding, not just correctness. Ask:

  • Why was this approach chosen?
  • What fails under load?
  • What breaks when assumptions change?

Reward engineers who can debug, profile, and reason under failure.
That’s where AI still stumbles—and where real engineers earn their keep.

Treat AI as infrastructure, not a toy

If AI tools are everywhere but governed nowhere, you already have a problem.

Standardize:

  • Which tools are allowed
  • How prompts are shared and versioned
  • How outputs are validated
  • How IP, data, and security are handled

Ignoring this creates shadow-AI, silent leaks, and unverifiable decisions. You wouldn’t let people deploy random databases to prod.
Don’t do that with AI.

Shift metrics away from “lines shipped”

Output metrics are (now) meaningless. AI inflates them by design.

Measure what actually matters (DORA style):

  • System quality / DevEX / Even Developer happniess
  • Incident recovery time
  • Change failure rate
  • Test coverage and signal
  • Architectural clarity

AI can help you ship faster. It cannot guarantee outcomes. Your metrics should reflect that reality.

Invest in orchestration skills

The future senior engineer doesn’t just write code. They design systems that coordinate intelligence.

Encourage work on:

  • Agent pipelines
  • Evaluators and guardrails
  • Feedback loops
  • Tooling that checks AI against reality

This is the new leverage layer. Treat it as a core skill, not a side experiment.

Protect deep expertise

Don’t flatten everyone into “full-stack generalists.”

You still need domain owners:

  • Performance
  • Security
  • Data
  • Infrastructure

AI boosts breadth.
Humans anchor depth.
Lose that balance and your systems will rot quietly—until they fail loudly.

Rebuild onboarding

Assume new hires will use AI heavily from day one.

Onboarding should teach:

  • How your systems actually work
  • Why key decisions were made
  • What invariants must not be broken
  • How to validate AI output against production reality

Otherwise you’re training people to copy confidently—and understand nothing.


For Engineering Teams

Use AI to kill boilerplate, not thinking

Let AI scaffold, refactor, and generate tests.

Humans own:

  • Architecture
  • Invariants
  • Edge cases
  • Failure modes

If AI is making your design decisions, your team is already in trouble.

Practice “AI-assisted debugging,” not blind trust

Always reproduce. Always measure. Always verify.

Treat AI like a fast junior engineer: helpful, confident, and occasionally very wrong. If you wouldn’t merge their code without checks, don’t do it for a model.

Document intent, not just code

Code shows what the system does. It rarely shows why.

Write down:

  • Why the system exists
  • What tradeoffs were made
  • What must never change

This documentation becomes the truth source when AI generates plausible nonsense at scale.

Continuously reskill horizontally

Each engineer should expand into at least one adjacent area every year:

  • Infra
  • Data
  • Product
  • Security

AI lowers the learning barrier. Use that advantage deliberately, or waste it.


For Individual Engineers

Master one thing deeply

Pick a core domain and become genuinely hard to replace there.

Depth is your moat. AI makes general knowledge cheap. It does not replace hard-earned intuition.

Learn how AI systems fail

Hallucinations. Bias. Brittle reasoning. Silent errors.

Knowing failure modes is more valuable than knowing prompts. Engineers who understand where AI breaks will outlast those who just know how to ask nicely.

Build visible, real projects

Portfolios beat resumes.

Show:

  • Systems you designed
  • Tradeoffs you made
  • How you used AI responsibly
  • How you validated results

Real work cuts through hype instantly.

Think in systems, not tickets

The future engineer isn’t judged by tasks completed.

They’re judged by how well the whole machine runs under stress.


Bottom Line

AI compresses execution time.
It does not compress judgment, responsibility, or accountability.

Teams that double down on thinking, architecture, and learning will compound.
Teams that chase raw output will ship faster…

…straight into walls.

The choice is not whether to use AI.
The choice is whether you’re building engineers—or just accelerating mistakes.

Standard
Business

Why Hybrid AI Approaches Are Essential for Developers

The AI tooling space has entered its loud phase.

Every week there’s a new “Copilot killer,” a leaked benchmark, or a dramatic Hacker News thread declaring that this model finally understands context / code / humanity. Under the noise, a real question matters to developers and teams:

Should we rely on closed AI tools, or is open source quietly winning where it counts?

This isn’t philosophy. It’s about velocity, trust, cost, and control.

Let’s ground this in actual developer work.

Continue reading →
Standard
Business

The Security Vendor Maze: Why SMBs Are Set Up to Fail

A founder asked me recently a simple question:

“How many security tools do we actually need to be protected like an enterprise?”

I gave him the honest answer.

Six to ten different platforms. Minimum.

There was a pause.
Then his face dropped.

Because in that moment, he realized what many SMB founders eventually discover the hard way: modern cybersecurity was never designed for companies like theirs.

Continue reading →
Standard
Business

Navigating Startup Success and Failure

Twenty-five years.
Six startups.
Two exits.
Four spectacular crashes into concrete walls.

People often ask me which taught me more—the wins or the losses.

The honest answer: you don’t get one without the other.

The exits validated instincts. They confirmed that when product, market, timing, and people line up, things move fast—almost effortlessly. You feel momentum. Customers pull you forward. Teams operate with clarity and purpose. You start to recognize patterns that work.

That’s valuable.

But the crashes?
Those were expensive. Brutal. Humbling.

They forced me to question assumptions I didn’t even know I was making. They taught me how fragile conviction can be when it isn’t backed by reality. They sharpened my ability to spot early warning signs, ask uncomfortable questions sooner, and trust that quiet internal signal when something feels off—even if the data hasn’t caught up yet.

That’s earned wisdom.

Along the way, I also had the privilege of working at Google, Meta, and Netflix—seeing execution at a completely different scale. World-class systems. Relentless focus. Talent density. A reminder that “moving fast” means very different things when reliability, trust, and millions of users are on the line.

I’ve seen both extremes:
Scrappy startups and tech giants.
Failure and massive success.
Chaos and precision.

That contrast reshaped how I think about building.
And it’s directly influencing what I’m working on next—what I believe may be my most important venture yet.

If you’re building something—or thinking about it—what’s the hardest lesson you’ve learned so far?

Not (only) the trophy story.
The scar.

How can you debrief it and improve?

Standard