The blog

The part vendors leave out.

Long-form on enterprise browsers, proxies, and enforcement. How it actually works, what the tradeoffs really cost. These are the canonical versions of what I post on LinkedIn.

2026
Introducing memd: memory your agents don't own

Every AI coding tool ships its own memory, and none of them talk. memd makes memory a folder of Markdown files you own, served to every agent over MCP.

Why RDP can't authenticate like SSH

SSH made passwordless, short-lived, identity-attributed access a one-line server config. RDP can get there too, through a chain of Active Directory machinery that explains why brokered access is winning instead.

The extension ceiling, part 4: DLP on the page vs the wire

Extension DLP inspects the page. Exfiltration happens in the request. Those are different objects, and the gap between them is where data actually leaves.

The enterprise browser and PAM are on a collision course

The extension versus full browser argument misses where the deals actually go. Privileged access lives at a broker, and the browser and PAM categories are converging on it from opposite sides.

The extension ceiling, part 3: the incognito bypass

Every extension-based DLP I tested loses sight of the user the moment an incognito window opens. The mechanism, and why policy can't fully close it.

The extension ceiling, part 2: Chrome sync and MDM scoping

Chrome sync will happily carry corporate state into personal profiles. What the MDM scoping rules actually cover, item by item.

The extension ceiling, part 1: mandatory screen recording

If your security tool needs to watch the screen to do its job, you have already left the extension model. The mechanics of why.

2025
What enterprise browser productivity numbers really mean

Vendors quote hours saved per user per week. How those numbers get made, and which ones survive contact with a real deployment.

Go vs Rust for proxy workloads: the choice and why

We pushed serious TLS traffic through both. The decision came down to GC pauses you can budget for versus lifetimes you pay for daily.

Merging the browser and the SASE stack

Consolidation slideware says one agent, one policy. The enforcement plumbing underneath says otherwise. What merging actually requires.

Prompt injection, from the enforcement side

What a gateway can and cannot do about prompt injection, written for people who have to sign off on AI tools this quarter.

Posted first onLinkedIn· canonical versions live here