Works
A complete archive of writing, talks, research, and press. Everything here carries my name or describes work I directly led.
★ — start here
Books & whitepapers
- Google Cloud Professional Cloud Architect, All-in-One Exam Guide★ 2021McGraw Hill. The official certification guide.
- Autonomic Security Operations: 10X Transformation of the SOC★ 2021The founding whitepaper of ASO, introducing the Continuous Detection, Continuous Response (CD/CR) operating model. With Dr. Anton Chuvakin.
- Modernizing the U.S. Federal Government's Approach to Cyber★ 2022ASO applied to federal policy — EO 14028, OMB M-21-31.
Courses & certifications
- Modern (Autonomic) Security Operations★ 2024Coursera certification. Six weeks, platform-agnostic.
- Autonomic Security Operations & Continuous Detection / Continuous Response 2024Google Cloud Skills Boost.
Writing
- Defense-in-Breadth★ 2024Essay on moving from defense-in-depth to defense-in-breadth — using AI to empirically understand and prevent risk.
- Modern SecOps Masterclass, now on Coursera 2024
- The Great Distribution★ 2023Market essay on AI-native companies and the redistribution of enterprise value. Written December 2023; published June 2026, unrevised.
- IT Prediction: The vast majority of security operations will be automated★ 2022
- Achieving ASO: Automation as a force multiplier — SRE lessons for security 2022
- Introducing ASO for the U.S. public sector 2022
- New resources to advance your ASO modernization journey 2022
- Announcing MITRE ATT&CK mappings for Google Cloud 2022
- Introducing Community Security Analytics★ 2022
- Modernizing the SOC: Introducing Autonomic Security Operations★ 2021
- Achieving ASO: Reducing toil 2021
- Leveraging network telemetry for forensics — an open-source blueprint 2021
Talks & keynotes
- Teleidoscope 2024Keynote, FootPrints '24 — MSU Vadodara, India.
- If you're not thinking about the future, you're living in the past★ 2023Keynote, SINFO 30 — Lisbon.
- Kubernetes detection & response 2023Technical panel, with Deepfence.
- Top 10 Cloud Technology Predictions★ 2022Google Cloud Next '22 Developer Keynote, ~33,000 attendees.
- An Autonomic Approach to the SOC: Applying SRE Lessons★ 2022mWISE, Washington D.C., with Dr. Anton Chuvakin.
- State of ASO: Are There Sharks in Your SOC? 2022Google Cloud Security Talks, with Robert Herjavec and Eric Foster.
- Live security Q&A 2021Google Cloud Next '21.
Podcasts
- Security Operations in the Age of AI 2025Zero Signal.
- Cloud Security Podcast EP63 — State of Autonomic Security Operations 2022With Robert Herjavec and Eric Foster.
- Cloud Security Podcast EP46 — Helping customers precipitate change 2021
- Cloud Security Podcast EP31 — Cloud certifications and cloud security 2021
Research & open source
Industry research I led or sponsored at Google, including the MITRE Center for Threat-Informed Defense partnership (30+ contributors).
- Community Security Analytics★Open-source detection analytics, Apache-2.0 — 40+ ATT&CK-mapped use cases.
- MITRE ATT&CK Security Stack Mappings for Google Cloud★49 GCP security capabilities mapped to ATT&CK. Repository.
- MITRE Cloud AnalyticsSigma + CALDERA research with MITRE CTID.
- ATT&CK for CloudMITRE CTID — Google was a lead participant.
- MITRE CTID Leadership Spotlight: Google Cloud★ 2022
Press & media
- Bloomberg — CISA urges automated testing★ 2023Quoted alongside CISA officials.
- Google Transform — Why AI and new tech can help security solve toil 2023
- Netenrich — Autonomic Security Operations fundamentals 2023
- AttackIQ Purple Hats Conference — speaker announcement 2023
- National Academy of Medicine — Case Study: The Mayo–Google Partnership★ 2022The "data behind glass" architecture, chronicled in the Learning Health System Series — the program whose security track I led.
- Forbes — Google Cloud launches the "SOC of the Future"★ 2022
- Infosecurity Magazine — How to build an autonomic SOC★ 2022Independent op-ed crediting him with coining the term.
- VentureBeat — Top 10 cloud predictions from Google 2022
- BankInfoSecurity — How to increase visibility into security threats 2022
- Mandiant mWISE 2022 — keynote lineup 2022
- Wealthsimple — How we're modernizing security operations 2022Customer-side account of an ASO adoption.
- InfoQ — Google Cloud security analytics 2022
- InfoQ — GCP announces MITRE ATT&CK mappings 2022
- ITOps Times — Open-source project of the week: CSA 2022
- Techzine — Google announces MITRE ATT&CK mappings 2022
- Cloud CISO Perspectives 2021–22Phil Venables's newsletter, crediting the ASO work. Dec 2021.
- TechTarget — Ready to be a GCP architect? 2021Quiz built from the McGraw Hill book.
Profiles & boards