7 min read
What Actually Breaks When You Put an LLM in Production
It's rarely the model. It's the retry logic nobody wrote, the cost budget nobody set, and the eval suite that didn't exist until after the incident.
AIEngineering
Read more →Notes on shipping AI systems, and the occasional detour into engineering and design more broadly.
It's rarely the model. It's the retry logic nobody wrote, the cost budget nobody set, and the eval suite that didn't exist until after the incident.
Treating the network as an enhancement rather than a requirement changes almost every decision you make, from data storage to how you show errors.
Embed, retrieve, stuff into a prompt: the tutorial makes it sound like a weekend project. The chunking strategy is where weekend projects go to die.
Most AI vendor demos are optimized to look good in a demo. Here's what I actually ask before recommending a client sign anything.
Running code physically closer to users isn't just a latency win. It quietly removes an entire category of infrastructure decisions.
The best design system I ever worked with had eleven components. The worst had over two hundred. More tokens is not the same as more clarity.
Fifty-two weeks of publishing something, even when it wasn't good. Here's what actually changed, and what I expected to change but didn't.
Every confusing bug is really a message from an earlier version of you who had less context and more confidence. Reading it charitably helps.
Learn how Zero Trust Architecture replaces outdated perimeter defenses with a never trust, always verify approach. Covers NIST SP 800-207, core pillars, ZTNA vs VPN, and phased adoption.
Automated scanners miss what a skilled attacker finds. Notes on why manual penetration testing remains essential for identifying real-world risk.
Understand why automated vulnerability scanning alone is insufficient. Learn about continuous validation, BAS, red teaming, purple teaming, and how to build a layered security testing program.
An in-depth analysis of supply chain attacks including SolarWinds, Kaseya, Codecov, and Log4Shell. Covers attack vectors, defense strategies, SBOM, and vendor risk management.
An in-depth exploration of the Ransomware-as-a-Service ecosystem, including the business model, major groups, underground economy, attack economics, and defensive strategies.
A step-by-step walkthrough of how modern ransomware campaigns unfold, from initial access to payload deployment and extortion.
Unsanctioned SaaS apps, personal cloud storage, and rogue devices create attack surfaces that your security team can't see or protect.
How modern phishing and social engineering have evolved beyond email, and the technical and human defenses organizations need to deploy.
A comprehensive guide to IoT security covering threat landscape, real-world attacks, enterprise IoT challenges, and practical defense strategies for connected organizations.
A playbook no one follows is worse than no playbook. Notes on building IR processes a team will actually use when pressure is highest.
Learn how to secure your CI/CD pipeline with DevSecOps best practices. Covers secret management, SAST/DAST integration, container scanning, IaC security, and a practical maturity model.
Understand the full financial impact of data breaches in 2026. Covers direct costs, regulatory fines, litigation, ransomware, business disruption, customer churn, and ROI of proactive security.
A comprehensive guide to multi-factor authentication covering MFA factors, phishing-resistant MFA, deployment strategies, and decision frameworks.
What SOC 2 really requires, common misconceptions, and a practical roadmap for achieving and maintaining compliance.
A comprehensive guide to container security covering Docker pitfalls, Kubernetes hardening, image supply chain integrity, and runtime protection for cloud-native workloads.
An in-depth look at why healthcare is the most targeted industry for cyberattacks, covering threats, regulatory requirements, and a practical security framework for hospitals.
A comprehensive guide to API security covering OWASP API Security Top 10, authentication strategies, rate limiting, input validation, and architecture patterns.
Why technology alone is insufficient for cybersecurity. Learn how to build a security-first culture through executive sponsorship, security champions programs, and effective awareness training.
Identify and remediate the most common cloud security misconfigurations in AWS and Azure, with detection tools, hardening frameworks, and compliance strategies.
How AI and LLMs are being weaponized for cyberattacks, and what defensive strategies security teams need to adopt in response.