The Renaissance Nerd

I.

De Artifice

On the Craftsman

For over two decades, I have walked the corridors between the ancient arts of strategy and the electric frontiers of cyberspace. Today I am Field CISO at Reflex Security, where we use AI to run tabletop exercises and incident simulations, so teams can live through a bad day before the real one shows up.

Before that I was VP & CISO at Warner Bros. and Director of IS Security at Amgen. I serve on the IANS Faculty, and I am the author of "The Cybersecurity Manager's Guide" published by O'Reilly. My philosophy draws from the martial art of Judo: use an adversary's force against them, and get the most done with the least wasted effort. Off the clock I build things, mostly honeypots, sensors and AI experiments running on a small home cluster, and I carry a camera everywhere.

🛠 CISSP #41535

⚔ GCIH Certified

📚 O'Reilly Author

🎓 IANS Faculty

Innovator

Pushing boundaries of what's possible while frustrating adversaries

Architect

Building security programs that stand the test of evolving threats

Teacher

Sharing knowledge through writing, speaking, and mentoring

Chronica Recentia What I have been up to lately

Oct 2026
Gave my honeypot a nervous system. Five days testing spiking neurons, hypervectors, reservoir computers and a BrainChip AKD1500 card against three years of honeypot data. Read the write-up
Oct 2026
Hacker Halted, Atlanta. Ran two live crisis simulations where the attendees worked the incident together as response teams.
Sep 2026
Morocco with a camera. Casablanca, Fes and Marrakech, shot mostly for the light and the people. See it in black & white or in the gallery below
Sep 2026
Blue Team Con, Chicago. Spoke on "Why Incident Response Plans Fail When It Matters."
Sep 2026
Shipped RatCatcher. A bird-feeder sensor that names birds by sight and by song. It has still never caught a rat. The story
2026
Fifty-plus repositories built with AI help. What worked, what lied to me, and what I would do again. Field report

II.

Armamentarium

The Arsenal

Open-source tools forged in the fires of real-world incident response, plus a growing pile of experiments. Most of the recent ones were built with AI as a pair programmer and run locally on my own hardware. Everything below is GPL-3 or BSD.

Nuper Fabricata Recently forged

🧠

SensorGrind

A self-evolving analysis pipeline for three years of all-ports, all-protocols honeypot logs. Dozens of detectors, now including neuromorphic ones.

Python

🐦

RatCatcher

Bird-feeder wildlife sensor: Raspberry Pi 5, two cameras, two microphones and a Hailo AI accelerator. Identifies birds to species by image and by sound.

Python

🖼

RAD PhotoFrame

Turns a $50 Android picture frame into a wall display of work status, after taking root away from the vendor's app.

Python

🔍

BleachMark

Finds watermarks and hidden signals in text written by language models, and tests how well they can be removed.

Python

💾

MnemonAI

A local-only memory server for AI agents (Model Context Protocol), written in C. Persistent, searchable, and stays on my own box.

C

🎣

Angler

Predicts good fishing days on US rivers and streams from federal water, weather and water-quality data. Runs locally.

Python

✨

StarPattern

Autonomous search for visual patterns in astronomical star fields, using evolutionary tuning across several sky surveys.

Python

🖥

Omarchy RetroPC Theme

A desktop theme for Omarchy that brings back the look of the good old days. The most-starred thing I have ever published.

Lua

💡

LED Monitor Daemon

System metrics on Framework Laptop 16 LED panels

C

More new work

Video2Text pulls contact lists out of videos of attendee apps and directories
ProfessorAI C daemon that wraps llama.cpp behind an OpenAI-compatible API
llm_compare has several AIs answer, then judge each other
podcastorum local podcast transcription and summaries
Vitia Invenire Windows supply-chain security assessment
USB Overwatch watches for malicious USB hardware
CheckGPC tests whether websites honor Global Privacy Control
Security & Privacy Inspector Chrome extension that checks security.txt and privacy settings
Sauron very fast IPv4 threat-scoring library in C
skill_ste100 & skill_oir-review Claude skills for Simplified Technical English and reviewing investigation reports
Prime_Plot visualizing and detecting prime number patterns

Games with AI players

Dungeons of Dreagoth II a Python sequel to my 1991 QBasic dungeon crawler
Scorched Earth MOAG the classic artillery game, with reinforcement-learning players
Spacewar! AI the 1962 original, flown by learning agents
AI Robots CROBOTS, but Claude, GPT, Gemini and Grok drive the robots
learn2drive a car that teaches itself to race

The classic arsenal

In Officina On the workbench, not public yet

Spoor an event visualizer that trains, measures and evolves its own threat detectors
Bulwark a firewall for AI tool calls (MCP), written in C, with per-tool policy and human sign-off
HoneyAI a honeypot where every attacker command is answered by a language model staying in character
ToxicSkillHunter & Invisible Ink a scanner for poisoned AI agent skills, and the attacker tool that tries to sneak past it
SpotFakeImage a layered examiner for AI-generated images and local edits
Bentley research into compressing transformer weights into codebooks
Volition does fine-tuning for "volitional" behavior beat prompting on the same weights?
Squad Leader Expeditionem the classic tactical wargame, rebuilt with AI opponents
Log Carver & Lightning a parallel log processor and a very fast Layer-4 load balancer, both in C
eBPF sensor an all-ports, all-protocols network attack sensor and honeypot
rf-fingerprinter software-defined radio tool that hunts for fake cell towers (IMSI catchers)
RADSoft an archive of my DOS-era utilities and BBS tools, circa 1991 to 1995

III.

Scripta

The Writings

O'REILLY

The Cybersecurity Manager's Guide

The Last Domain

2021

Published Works

Exploring "the art side" of information security - the human elements that technical manuals overlook. Leadership, culture, and the philosophy of defense.

"Making Sense of Logs" - USENIX ;login:
"Someone to Watch Over Me" - SLAML, with Marcus Ranum
"Information Security: Learn the Lessons of the Sumo" - ComputerWeekly
"Beyond Defense-in-Depth", "Network Metrics and KPIs", "Selling Packet Vacuums Door-to-Door" - IANS

In Progress

Incident Response Preparedness Maturity Model - white paper, with Cassio Goldschmidt
Building Sustainable Security Culture Through Game Theory - paper
The Decline and Fall of the American Experiment - book

Orationes Recent talks

2026Why Incident Response Plans Fail When It MattersBlue Team Con, Chicago
2026Live crisis simulation workshop (two sessions)Hacker Halted, Atlanta
2025Building a Cybersecurity Team in the Age of AIPlanet Cyber Sec
2025Cybersecurity & AIISSA-LA
2024Unleashing the Power of AIPlanet Cyber Sec
2023Zero Trust OdysseyAT&T Security Conference

Latest from the Blog

"The mad ramblings of a cyber security curmudgeon (in training)"

Oct 28, 2026

We Can Rebuild It: What Happened When I Gave My Honeypot a Nervous System

An offhand comment about neuromorphic math, five days of experiments, and a real BrainChip card turned loose on three years of honeypot data.

Henna-patterned hand, black and white, Morocco

Oct 18, 2026

Morocco in Black & White

One of the most colorful places I have been, shot without the color so the work and the faces carry the picture.

Oct 15, 2026

Turning a $50 Picture Frame into a Double Agent

The vendor app hands root to a server I know nothing about. I spent two days turning the frame into an office dashboard anyway.

RatCatcher sensor box with cameras and microphones mounted outdoors

Sep 18, 2026

The Rat Catcher That Has Never Caught a Rat

A Raspberry Pi 5 sensor built to spot rats at the bird feeder, which turned out to be much better at birds.

Aug 14, 2026

You Cannot Name the Stain

Hunting watermarks in language model output, and finding two different kinds of stain where I expected one.

Jul 31, 2026

Get Good at Getting Breached

Vulnerabilities now get exploited faster than anyone can patch them. Prevention alone will not save you, so practice the response.

Jul 25, 2026

Nobody Voted to Un-Invent Alternating Current

The gap between what people think AI can do and what it actually does, and why accountability and supervision matter more than hype.

Jul 9, 2026

Fifty Repos Later: A Field Report on Building With AI

Sixteen months of building with AI tools: where they sped me up, and where they handed me confident, wrong results.

Jun 19, 2026

I Built the Fishing-Forecast Tool Some PhDs Told My Friend He Couldn't

Federal data, a local model, and an honest name for what the forecast can and cannot tell you.

Jun 5, 2026

What an Ultra-Low-Interaction Honeypot Sees When You Watch for Years

On one day in May 2026, a Raspberry Pi in California heard from 310,119 different IP addresses. Here is what they were doing.

Visit iamnor.com for all posts →

IV.

Imago

The Images

Beyond the terminal, I capture moments through the lens. Photography is another form of pattern recognition - finding beauty in chaos, stories in stillness. Most of what is here is recent: Morocco this fall, the streets of New York, and a few birds my sensor caught.