SaaS PE Is Dead, Long Live SaaS PE! (Part 2 of 2): What a Buyer Actually Tests
If the badge in the footer is noise, what's left to check? The scope of a SOC 2 report tells you more than its opinion does.
Read moreBlog
Insights & Perspectives
Also published on Substack. Subscribe there to get new posts by email.
SaaS PE Is Dead, Long Live SaaS PE! (Part 1 of 2): What AI Actually Killed
AI made surface credibility free. That kills a lot of software companies. It also makes the good ones possible to tell apart for the first time in years.
Read moreThe Product Owner's Hat: Why Technical Strength Matters in AI-Forward Development
Building personal projects with AI agents taught me how much the product owner seat shapes the outcome, and why technical depth in that seat matters more than it ever has.
Read moreRetiring the 90-Day Password Reset Under PCI DSS 4.0
PCI DSS 4.0 finally gives you two legitimate ways to drop forced password expiry. Here is when MFA alone is enough, and how to build a customized approach that survives your QSA.
Read moreSingle-AZ Isn't Wrong. Accidental Single-AZ Is.
The AWS us-east-1 outage was a reminder that every architecture is a bet on availability. Here's how to make sure yours is a deliberate one.
Read moreBuilding an ISMS From Scratch: A Practitioner's Playbook
When there's nothing to inherit — no policies, no risk register, no documentation — here's how to build an information security management system that actually works.
Read morePCI DSS 4.0: What I Learned Leading the Migration
After leading our PCI DSS Level 1 migration across multiple entities, here are the lessons that surprised me most — and what I wish I'd known going in.
Read more