Tech Summit Q&A
Charles Herring
16 September 2026
Answers to the questions that came into my session at Tech Summit 2026 on Cybersecurity in the Age of AI
Tech Summit: Cybersecurity in an AI Age
Charles Herring
14 September 2026
I presented "Cybersecurity in an AI Age" at Canterbury Tech Summit 2026. Here is the practice recording and the full argument: why these machines guess, what criminals are doing with that, and the eight controls that still hold.
Search for Cybersecurity's Unit of Work
Charles Herring
18 August 2026
Sales manages opportunities. Uber manages trips. Hospitals manage patients and beds. Naval Aviation managed gripes and readiness. Navy cybersecurity, when I arrived 24 years ago, managed nothing at all. On the unit of work we went looking for, and found.
AI Attack Slop: Cybersecurity's Newest Script Kiddies
Charles Herring
16 August 2026
115 breach attempts hit our network in one day. 16 were driven by AI agents. Zero got in. The "agentic attacker" turns out to be unimaginative, derivative, and losing to the same hygiene that beat the teenage authors of Blaster and Sasser.
Trash Bags and Shoeboxes
Charles Herring
14 August 2026
If you stuffed a year of receipts into trash bags and dumped them on your accountant every April, they would stop taking your calls. That is what our industry hands law enforcement, and then we wonder why nobody prosecutes cybercrime.
The Deterrence Delusion
Charles Herring
12 August 2026
Ninety-two percent of business owners say they would call the police about a ransomware attack. Eighteen percent of actual victims do. The reason cybercrime feels unattributable is not physics. It is that we shred the evidence at ingest.
Quantum Leap: The Strangest Year of My Life
Charles Herring
27 July 2026
The last 12 months have been the strangest year of my life. A new country, a new way to build software, a multi-million-dollar retirement offer I turned down, a badly broken leg, and a product line I never expected to build twice and a deepening gratitude for life. Also, a lot of talk about a sci-fi show.
Hard-Earned Trust, Automated Away
Charles Herring
3 July 2026
Someone stood up a slick "WitFoo Authorised Partner" store selling licences we never made, and the registrar's abuse desk answered with a form letter. A look at counterfeit partner programmes, the supply-chain risk they create, and what happens when we automate away the judgement that trust actually depends on.
Fish in a Box
Charles Herring
25 June 2026
Twenty years ago a young sailor quoted "Fish's second rule of troubleshooting"
back to me, and I realised I'd been writing rules I never wrote down. This is the
story of how we used AI to inventory, argue over, and ratify the norms that run
WitFoo, from "The WitFoo Way" of coding all the way out to a thing we call
Fish-in-a-box.
The Haystack and the Needles: Why Lossless Cybersecurity Analytics Require Deterministic Pipelines
Charles Herring
23 June 2026
We cut the haystack by more than 95% and lost not one needle. I have come to believe that is only possible one way, and the probabilistic shortcut the whole industry is reaching for can never get there.
Adversarial Code Review Example with Claude
Charles Herring
18 June 2026
Below you will find my adversarial review prompt that I give to Claude on every pull request review. This is a living document that references dozens of cascading documentation. Collectively, over 1,700 norms contained in the "WitFoo Way" are reviewed. Also, the integrity of the work done by what is often a lazy or dishonest Claude session. In spite of the rigorous testing I outlined in Coding with Claude: What I've Learned Building a Cybersecurity Platform with AI , Claude finds new innovative ways to come off the rails. I use this prompt in an independent session to find shortcuts and lies from the PR session. I have run this prompt dozens of times and it has never come back without hits.
The Weight Guesser and the Scale: How I Actually Use AI
Charles Herring
29 May 2026
My feed swings between AI worship and AI scorn. After a year of using these tools hard, here is the unromantic version: a language model is a very good guesser. Once you see prediction and measurement as two different jobs, both the hype and the cynicism fall apart.
Which Detective Would You Hire? The Case for Deterministic Cybersecurity
Charles Herring
13 May 2026
Two detectives, same case. The one who guesses fast, or the one who shows her work? Why cybersecurity can't run on lucky guesses — and how empathetic processing bridges the two.
A Walk Through Christchurch
Charles Herring
25 April 2026
The counterpoint to being disoriented in New Zealand has been finding a better balance than I ever had in the US. A fifty-minute walking tour of the city, the rituals that anchor my days, and a love letter to my new home.
Podcast: Adventures of Alice & Bob
Charles Herring
23 April 2026
In this episode, James talks to Charles Herring about what happens when an IT wizard runs away to join the Navy, works on fighter jets, and then gets thrown into cybersecurity right after 9/11? He shares his unconventional journey from the Wild West days of network defense, complete with fighting worms with worms—to being CISO during the Target breach. Plus: why trauma creates silos, why your SOC is like throwing receipts in garbage bags, and what it takes to build a "good neighborhood" in cybersecurity.
Three Prompts That Turn Your Data Lake Into an Empathetic Processor
Charles Herring
22 April 2026
Earlier this week, WitFoo and the University of Canterbury released 100 million labelled cybersecurity records to Hugging Face under Apache 2.0. Here's a three-prompt walk-through for putting it to work in a stack you already own (Grafana, Sentinel, Splunk, Elastic), using Empathetic Processing to translate, detect, and visualise across your own data.
Blaster, Mythos, and the Patching Tempo We're About to Need
Charles Herring
8 April 2026
In 2003 at the Naval Postgraduate School, the Blaster worm taught me hard lessons about patch windows, perimeter assumptions, and the laptops that walk in from outside. With Anthropic's release of Mythos, we're about to relive a version of that August, compressed and supercharged. Here's the guidance I gave my team and what I wish I'd known in Monterey.
Why the Fork: Addressing the Objections
Charles Herring
2 April 2026
After publishing The Nuclear Code Fork, smart engineers pushed back with reasonable objections: use mature projects, wait for stable releases, pin your versions, trust the process. Every one of those heuristics was right once. Here's why they're wrong now, with specifics from Log4j, Trivy, LiteLLM, and tj-actions.
The Nuclear Code Fork
Charles Herring
30 March 2026
We killed all 450 external dependencies in our analytics platform and brought every line of code in house. It took two days, ~305K tokens, and uncovered 14 vulnerabilities that were already sitting in our stack. Here's why we did it, what we found, and what it actually cost.
Dragon 305: AI Lessons from the Flight Deck
Charles Herring
19 March 2026
In November 1998, a terrified young sailor stepped onto the flight deck of the USS Kitty Hawk during night operations and had to make a hard choice under impossible pressure. Twenty-seven years later, the tech industry could use that same lesson.
Tokens, Time and the New Math of Getting Things Done
Charles Herring
17 March 2026
A new framework for planning projects that blends AI token costs with human labor rates, breaking work into classes of effort where cost, speed and quality can be optimized across every sub-task.
Lost in Space, Time and Standards
Charles Herring
16 March 2026
I anticipated most of the challenges of moving to New Zealand. Immigration, housing, saying goodbyes. What I didn't anticipate was how exhausting it would be to relearn space, time and standards. When seasons run backwards, Mondays happen twice, and you find yourself whispering 'I miss inches' in bed, the cumulative toll is real. Fortunately, wonder makes a good coping mechanism
Supersonic Broken Processes: The Hazards of Automating Cybersecurity with AI
Charles Herring
15 March 2026
You cannot accelerate a process to supersonic speeds if it barely works at five miles per hour. Applying Anthropic's 4D Framework for AI Fluency to cybersecurity automation reveals that all four D's (Delegation, Description, Discernment, Diligence) fail when built on the same siloed, philosophy-free foundations that have plagued SECOPS for decades. The consequences in our field are uniquely severe: the AI can't go to prison when it gets it wrong.
How AI was the Best Bender of My Life
Charles Herring
11 March 2026
I built guardrails for the code, the architecture, and the security. I forgot to build guardrails for myself. After an eight-month megasprint rebuilding 10 years of work with Claude, I ended up on bedrest for a week. Turns out AI-assisted development is the most potent productivity drug ever created, and the dose that makes it medicine and the dose that makes it poison are closer together than you'd think.
The Closing Window: AI's Value-to-Cost Ratio Is Shifting Fast
Charles Herring
4 March 2026
In September, I burned through an entire GitHub Enterprise token allocation and barely noticed — the overages cost pennies. I rated that moment at 1,000:1. Value to cost. By February, I'm spending $2,000 a week on similar workflows. The ratio is now 600:1 and falling.
The window isn't shut. But it's moving. Here's what I think is driving it, and what I'm planning for when it closes.
