Field Notes From the Frontier.
Direct analysis from the specialists doing the work — what we're seeing across AI and agentic security, embedded and critical-systems security, and post-quantum migration, written plainly, without the marketing layer.
AI & Agentic Security
Securing systems that act on their own — agent identity, tool authorization, prompt injection, and the model supply chain.
Your AI Agent Is a Privileged Identity. Treat It Like One.
The moment a system can call tools and act without a human in the loop, it stops being a feature and becomes an identity — and most programs are still provisioning it like neither.
The Agentic Attack Surface Lives Between Models and Tools.
The model gets evaluated. The tools get reviewed. The seam connecting them — where a model's output becomes a tool's instruction — usually gets neither.
Prompt Injection Isn't a Bug You Patch. It's an Architecture You Design Around.
There is no input filter that reliably separates instructions from data in natural language, because to the model there is no difference. Defense has to live in the architecture, not the prompt.
Your Agent's Tools Are Its Real Permissions. Scope Them Accordingly.
A model that can call tools has exactly the authority of those tools — not the authority you intended, and not the authority its prompt politely requests. The gap is where agentic incidents live.
Treat Model Output the Way You Treat User Input: As Untrusted.
Every classic injection — SQL, XSS, command, SSRF — comes back when a model's text is piped into a database, a browser, a shell, or an HTTP client without the validation you'd demand of any other source.
RAG Puts Untrusted Documents Inside Your Trusted Prompt.
Retrieval augmentation was supposed to ground the model in your data. It also quietly turned every document in your index into something that can issue instructions to your agent.
Every Tool Server You Connect Is Code You've Decided to Trust.
A tool server extends your agent with new capabilities — and with whatever its author decided those capabilities should quietly also do. Connecting one is a trust decision, not a configuration step.
Non-Human Identities Already Outnumber Your Humans. Did Anyone Provision the Agents?
Every autonomous agent needs credentials to act. They're being created faster than any joiner-mover-leaver process was built to handle, and almost none have an owner, an expiry, or a review.
An Agent's Memory Is Persistent, Attacker-Writable State.
Give an agent long-term memory and you've given it a database that untrusted input can write to and future sessions will trust implicitly. Poison it once, influence it forever.
You Didn't Train It, You Downloaded It. That's a Supply Chain.
Open weights, fine-tunes, and community checkpoints are code you execute with enormous privilege and almost no provenance. The model file is a dependency like any other — and a less inspectable one.
Embedded & Critical Systems Security
Trust anchored in silicon — secure boot, provisioning, key storage, and the physical attacks that test them.
Secure Boot Is a Chain. The Weak Link Is Key Management, Not Code.
Every stage verifies the next — until the signing keys that anchor the chain turn out to live on an engineer's laptop. Where boot security actually fails, and what a defensible root of trust looks like.
Your Root of Trust Is Only as Honest as the Factory That Installed It.
Every security property of a device traces back to secrets injected at manufacture — often in a contract factory you don't own, don't staff, and can't fully observe.
Remote Attestation Is How a Device Proves It Hasn't Been Tampered With.
Measured boot records what ran; attestation is the part that makes a remote verifier believe it. The gap between the two is where device trust quietly collapses.
The Update Channel Is the Most Attractive Attack Surface You Ship.
A device that can update itself can be updated by someone else. Secure OTA is less about pushing bytes than about who is allowed to decide what runs next.
You Can't Patch What You Don't Know You Shipped.
A firmware image is a bill of materials you assembled and then forgot. When a vulnerability lands in a component three layers down, the question is whether you can even find it in your fleet.
The Debug Port You Forgot to Close Is the One They'll Use.
JTAG and SWD are indispensable in the lab and catastrophic in the field. Most "locked" debug interfaces are locked in a way a patient attacker simply undoes.
Where Device Keys Actually Live Decides Whether They're Secrets at All.
A private key in external flash is a public key with extra steps. Key storage on constrained devices is a hierarchy of bad-to-good options, and most designs sit lower than they think.
Memory Safety Is Still the Bug Class That Owns Your Firmware.
Decades on, the overwhelming majority of exploitable firmware bugs are still memory-safety bugs — on devices with no ASLR, no sandbox, and often no MMU to catch them.
Fault Injection Turns Your Correct Code Into an Attacker's Tool.
Your signature check returns the right answer every time it runs. Fault injection is the art of making sure it doesn't run — a single skipped instruction, and the branch you trusted inverts.
The Chip Tells You the Key If You Know How to Listen.
Constant-time code is a start, not a finish. Power draw, timing, and electromagnetic emanations leak secrets through channels the datasheet never mentions.
The Cyber Resilience Act Turns Firmware Security Into a Market-Access Requirement.
For products with digital elements sold into the EU, security stops being a quality nicety and becomes a condition of the CE mark. Much of what the CRA asks for is exactly what good embedded engineering already does — and exactly what most products skip.
Post-Quantum Security
Migrating cryptography before the quantum horizon — asset discovery, hybrid key exchange, agility, and constrained devices.
PQC Migration Is an Asset Discovery Problem Before It Is a Cryptography Problem.
Choosing ML-KEM over a legacy key exchange is the easy decision. Finding every place your organization actually relies on cryptography first is the one that takes years.
The Quantum Attack That's Already Happening Is the Recording.
You don't need a quantum computer today to be a victim of one tomorrow. Encrypted traffic captured now and stored can be decrypted the day the capability arrives — which makes your data's shelf life the real deadline.
Signatures and Key Exchange Are Two Different Migrations. Don't Run Them as One.
Harvest-now-decrypt-later makes key exchange urgent today; signatures mostly protect against a future forger. Conflating the two timelines wastes effort on the wrong thing first.
Hybrid Key Exchange Is How You Migrate Without Betting on One Algorithm.
You don't have to choose between a battle-tested classical algorithm and a young post-quantum one. Combine them so the handshake stays secure unless both break — and ship before the standards fully settle.
Post-Quantum TLS Breaks at the Handshake, Not the Cipher.
The symmetric encryption protecting your sessions is largely fine. It's the handshake — the key exchange and the certificate chain — that a quantum adversary dismantles, and that's the part hardest to change.
Your Certificates Will Outlive the Assumptions They Were Signed Under.
A root CA issued today can be trusted for twenty or thirty years. Any certificate whose validity stretches past the quantum horizon is signing a promise its algorithm may not be able to keep.
Crypto-Agility Is Designing for the Algorithm You Haven't Chosen Yet.
The organizations that will migrate to post-quantum cheaply are the ones that already stopped hard-coding algorithms years ago. Agility is an architecture property you build before you need it.
Post-Quantum Cryptography Has to Fit on Devices That Have No Room.
The PQC standards were a triumph of cryptography and a problem for embedded engineers. Kilobyte keys and signatures don't drop neatly into a microcontroller with tens of kilobytes of RAM and a decade in the field.
NIS2 Makes Cryptographic Governance Something You Have to Be Able to Show.
Risk-based security, supply-chain diligence, and management accountability — NIS2 pushes essential and important entities toward demonstrating control of their cryptography, not just asserting it. You can't govern what you haven't inventoried.