JOURNAL / IDEAS IN PUBLIC
A point
of view.
Articles by Levon Azevedo on technology, AI and security. The full stories behind our social posts, including Tech Evolution and When, Not If.
41 articles
01Lab milestone · 2 min
After months of waiting, Black Ice Labs has access to Claude Mythos 5.1
After months of waiting, Claude Mythos 5.1 is available for our defensive research. A milestone for the lab, and the projects we want to advance next.
Voice narration availableTech Evolution · 3 min
The cost of a task that actually finishes
A cheaper model can leave you with a more expensive task. A model invoice counts tokens. The job includes the attempts that failed, the tools that ran and the person who repaired the result. If those costs disappear…
Voice narration availableForged · 2 min
The resources have to follow
Responsibility gets expensive when the person carrying it doesn't have the tools to do the job. A title won't debug a failing service, and an escalation path won't give someone the access they need to investigate it.
Voice narration availableForged · 2 min
Waiting needs a trigger
Waiting becomes a management decision when you can explain what would end the wait. Until then, it can be a polite way of leaving work without an owner.
Voice narration availableTech Weekly · 2 min
Your patch list needs context
CISA set September 28 as the end of its weekly Vulnerability Bulletin. Its September 16 announcement pointed readers toward the Known Exploited Vulnerabilities catalog, alerts and vendor advisories instead.
Voice narration availableForged · 2 min
Inventory before impossible
A plan can look impossible because nobody has listed what is actually available yet. The deadline is real. The assumptions around it still need checking.
Voice narration availableWhen, Not If · 2 min
A log needs someone at the other end
A security incident can begin with a question your business can no longer answer: who changed that account?
Voice narration availableTech Evolution · 4 min
A task ends. Its permission should too.
An AI agent can finish a task while the permission granted for that task remains available. The work stops. The credential may not.
Voice narration availableForged · 2 min
Show the standard before the review
A review gets expensive when the team discovers the standard after the work is finished. By then, every correction competes with a deadline somebody already promised.
Voice narration availableTech Weekly · 2 min
Test the recovery route after the passkey
A passkey rollout needs a recovery test. Getting the normal sign-in right still leaves the question of what happens when someone loses their device.
Voice narration availableWhen, Not If · 2 min
Who still has access after the contract ends?
A supplier's final invoice can be paid while their admin account still works. The commercial relationship has ended. The access hasn't.
Voice narration availableTech Weekly · 2 min
Patched is not the same as clean
Patching an exploited vulnerability and assessing whether it was used are separate jobs. A team can finish the update and still leave the incident question unanswered.
Voice narration availableForged · 2 min
The org chart is the wrong map in a crisis
An organization chart is a good answer to a calm question: who decides what, and who reports to whom. It is a poor answer to the question a crisis actually asks, which is simpler and more urgent. Who is needed, where,…
Voice narration availableTech Evolution · 2 min
Cheaper per token, but the money didn't follow
The September reports describe a substantial fall in AI token prices. The money did not follow the tokens. The distance between those two facts is where much of the practical engineering work in applied AI now sits, and…
Voice narration availableWhen, Not If · 2 min
Deleted, not encrypted: when the attack is erasure
Most incident plans in small and mid-sized companies are built around one picture. The files are still there, locked, and someone wants money for the key. The backup exists so you don't have to pay, and recovery means…
Voice narration availableForged · 2 min
Do not grieve a failure before you measure it
Don't grieve a failure before you've confirmed it. A project can be mourned before it has been measured.
Voice narration availableTech Weekly · 2 min
Your FIPS claim needs a certificate
A cryptographic implementation can keep working while its validation status changes. That is what the September 2026 FIPS 140-2 transition makes visible: the code and the certificate answer different questions.
Voice narration availableForged · 2 min
The same story, told from different sides
The same story, told thirty times, is not repetition. It's perspective, taught one angle at a time.
Voice narration availableWhen, Not If · 2 min
Three cloud settings and their owners
A cloud service changes who runs parts of the infrastructure. It does not transfer every security decision to the provider. The customer still needs to understand the accounts, data and settings under its control.
Voice narration availableForged · 2 min
A corrected mistake is a page turned
A mistake needs correction and a clear account of what allowed it to happen. It should not become a permanent verdict on the person who made it.
Voice narration availableWhen, Not If · 2 min
A breach plan needs a page for mistakes
A response plan that begins only with an attacker breaking in misses another category of privacy incident. Information can be lost, sent to the wrong person or disclosed by someone who already has legitimate access.
Voice narration availableForged · 2 min
The right to walk away
A team needs a meaningful way to decline critical work before treating agreement as commitment. A yes is hard to interpret when the person believes that saying no will cost them their standing.
Voice narration availableForged · 2 min
Status is shared memory
Saying where you are helps people avoid doing the same work twice. The useful information is often a change of state: someone has taken ownership, found a dependency or finished a handoff.
Voice narration availableTech Evolution · 5 min
Human in the loop is a queue
AI-generated pull requests move effort into review, and review has a wait time. Four datasets measure that cost in different ways; none of them makes the human in the loop free.
Voice narration availableForged · 2 min
Self-control is a gap you train
The space between a trigger and a response is not a personality trait. It can be located, protected with a rule set in advance, and trained like any other skill.
Voice narration availableWhen, Not If · 3 min
How to tell if the person guarding your data knows anything
Alberta's PIPA keeps an organization responsible for the compliance of the people it engages. Five documents show whether an outside provider is actually protecting your data.
Voice narration availableTech Evolution · 3 min
The attacker changed. The door didn't.
Criminals running agents, a lab's own agents and a survey of breached organizations point to the same way in: exposed, poorly governed credentials. What changed is the speed of whoever finds them.
Voice narration availableTech Weekly · 5 min
When a suspected exploit becomes reportable
Under the EU Cyber Resilience Act, the first 24 hours begin when a manufacturer has reasonable certainty that a vulnerability is being actively exploited. The useful operational record begins before the report.
Voice narration availableForged · 4 min
The minimum viable yes
A smaller commitment is not a lesser commitment when it creates visible evidence, a date, and a clear next decision.
Voice narration availableTech Evolution · 8 min
We Benchmark Agents at 50%. We Deploy Them at 99%.
The field publishes agent time horizons at 50% and 80% reliability. Serious production decisions are made at 98%+ — and METR says in writing that the 99% number cannot be fit at all with the benchmarks that exist. The…
Voice narration availableTech Evolution · 9 min
The Attack Surface Moved Into the Tool List
A backdoored LiteLLM release, a 9.6-severity flaw in mcp-remote, and 200,000 vulnerable MCP server instances: the 2026 CVE record shows prompt injection and tool poisoning have moved from lab scenario to production…
Voice narration availableWhen, Not If · 13 min
What Alberta Law Actually Requires the Day You Find Out
The day you find out, you may have three sets of legal obligations, not one — different thresholds, different clocks, different lists of who must be told. PIPA, PIPEDA and HIA mapped against each other from primary…
Voice narration availableTech Evolution · 9 min
The Bottleneck Moved to the Spec
Developers now spend more time reviewing AI-generated code than writing it — 11.4 hours a week versus 9.8, a reversal a fresh Q1 2026 survey confirms. The industry's answer is spec-driven development, adopted by eight…
Voice narration availableWhen, Not If · 4 min
The cheapest developer you ever hired
Canadian courts have been kind to breached companies — but Setoguchi describes a fact pattern, not a shield, and Owsianik left negligence, contract and statutory claims alive. Negligence asks whether your conduct was…
Voice narration availableTech Evolution · 10 min
Smarter Models, Same Spreadsheet
Model capability rose fast and verifiably — Humanity's Last Exam from under 10% to 38.3% in a year, SWE-bench Verified to 76.8% by February 2026 — while value capture inside organizations did not keep pace; buyer data…
Voice narration availableWhen, Not If · 2 min
Your backup is a belief, not a system
90% of security leaders are confident they can recover from a cyber incident; among organizations actually hit by ransomware, 28% got all of their data back — the distance between those two numbers is the distance…
Voice narration availableTech Evolution · 9 min
You Can't Audit a Belief
Agent capability is scaling like software while accountability still scales like headcount — 82% of executives believe policy covers them and only 21% have runtime visibility into what their agents are doing; the…
Voice narration availableWhen, Not If · 3 min
Alberta doesn't require you to tell your customers
Under Alberta's PIPA, the legal duty after a breach is to notify the Commissioner (s. 34.1) — notifying customers is a decision the law leaves with the Commissioner (s. 37.1); yet 80%+ of organizations notify on their…
Voice narration availableTech Evolution · 9 min
Attackers Don't Have to Be Right
AI's security asymmetry isn't offensive capability — offense tolerates being wrong and defense can't, so the cost of verification per action, not model quality, decides where autonomous defense lands.
Voice narration availableTech Evolution · 8 min
Code Got Cheap. Trust Didn't.
AI scaled code generation ~3x but verification scaled 0x, migrating the bottleneck (and the senior-engineer cost) into review/release — and standard metrics measure the wrong scarcity.
Voice narration availableTech Evolution · 7 min
Every Agent Is a Principal Now
Machine identities outnumber humans 109:1 and 79 of them are AI agents; identity is the unglamorous layer that decides whether enterprise agent adoption compounds or stalls.
Voice narration available