Michael Faas

You have MFA. That describes a purchase.

Aug 24, 2026

•

5 min read

You have MFA. That describes a purchase.

Every form asks whether it's on. None of them asks what can get in without it.

Michael Faas

I Gave an AI Read Access to a Client Folder

Aug 16, 2026

•

5 min read

I Gave an AI Read Access to a Client Folder

Six weeks of telling founders how to triage AI decisions, turned inward.

Michael Faas

What it costs to be the one who pulls the plug.

Aug 11, 2026

•

5 min read

What it costs to be the one who pulls the plug.

There's AI running in your company that nobody approved. All of it is live.

Michael Faas

Aug 2, 2026

•

5 min read

You never said no. You said later.

Last week the AI bets you kept got a name on them and a limit around them. This week, the ones you should not have kept at all. There is always a meeting where a bet gets started. There is no meeting where a bet gets killed, so bets do not die. They get postponed until they ship anyway, and then the no arrives as a rollback, at the most expensive moment available.

Michael Faas

Jul 26, 2026

•

5 min read

You kept the bet. Whose name is on it?

Last week you split the AI bets you can survive getting wrong from the ones that end you. This week: what happens to the survivors, which is usually nothing. Keeping a bet is a decision about the bet. It is not a decision about who runs it. A kept agent with no name on it and no limit on its reach is still running on hope. You just moved it to a more comfortable pile.

Michael Faas

Jul 19, 2026

•

5 min read

Not all of your AI bets are survivable.

Last week you could finally see an agent's reach, because it comes back as a list: the exact systems one credential opens. Here is what that list is for. The items on it are not equal. Some of those reaches you can survive getting wrong. Some of them end the business. The adoption decision was never whether to use AI. It is which of these bets you can afford to lose. Some earn a model. Most you just decide. The whole skill is telling which is which.

Michael Faas

Jul 12, 2026

•

5 min read

You're reading the wrong document.

Last week: an AI agent fails outward, so go look at the wires. Here is the catch. You cannot see how far one reaches by reading its job description. You can only see it by tracing its access. The prompt is a request; the token is a fact. An agent's blast radius is not what you asked it to do. It is what its credential can touch, and nobody ever wrote that width down.

Michael Faas

Jul 5, 2026

•

5 min read

Finding where AI goes is the easy half.

Everyone is about to sell you an AI roadmap: where it goes, what to automate, which agent lands where. That map is becoming a commodity; every consultant has the same one. The question almost nobody is selling you is the one that actually decides the outcome: which of these bets can your business survive getting wrong? That is not an opportunity problem. It is a cascade problem.

Michael Faas

Jun 28, 2026

•

1 min read

New post

One week's breath. The archive is the assignment.

Michael Faas

Jun 21, 2026

•

5 min read

It was never about vulnerabilities.

Six weeks I spent on vulnerability triage. Here is the confession at the end of it: triage was the easiest place to show you the discipline, not the only place it lives. The same move scales to vendor risk, AI procurement, the budget, the next hire. This was never about vulnerabilities. It is about how you decide under uncertainty in a system too complex to score.

Michael Faas

Jun 14, 2026

•

5 min read

When NOT to measure.

For five weeks I taught you to measure. Here is the part that makes it discipline instead of a tic: knowing the decisions that do not earn a model. One week after I opened a paid measurement pilot, here is me telling you when measuring is the wrong move.

Michael Faas

Jun 7, 2026

•

5 min read

Stop Inheriting the Scanner's List

For three weeks I showed you how to shrink forty-seven "criticals" to three and say the risk in dollars. Here's the part I left out: doing it yourself is the hard part. So I'm opening three pilot slots to do it with you.

Michael Faas

May 31, 2026

•

5 min read

47 criticals...you can fix 3.

A scanner handed one firm forty-seven "criticals" and a five-month queue. Watch probability and cost shrink it to three, reorder it, and turn it into a number a board can hear.

Michael Faas

May 24, 2026

•

6 min read

You're sorting by the wrong number.

One Exchange flaw. Two severity scores that don't agree. A six-percent probability that's actually in the ninety-first percentile. The number on your screen was never the question.

Michael Faas

May 17, 2026

•

4 min read

Severity is not probability.

You patched a 9.8 last week. A 7.8 was the one getting popped. CISA's KEV list keeps publishing the gap. Most security teams keep ignoring it.

Michael Faas

Your AI has a trust model. You didn't write it.

May 10, 2026

•

4 min read

Your AI has a trust model. You didn't write it.

Pillar Security found a CVSS 10 in Google's Gemini CLI last month. Not a coding error. A trust error. Your AI tools all have it. Most organizations haven't designed the answer.

Michael Faas

9 in 10 SMBs have a compromised user right now.

May 3, 2026

•

4 min read

9 in 10 SMBs have a compromised user right now.

The question isn't whether. It's whether anyone is watching.

Michael Faas

You Bought a Product. It's Running a Process You Never Designed.

Apr 26, 2026

•

4 min read

You Bought a Product. It's Running a Process You Never Designed.

AI coding agents aren't the tool you bought. They're the process you have to govern — and that's a leadership gap, not a tooling gap.

Michael Faas

Security doesn't fail in silos — it fails in cascades.

Apr 19, 2026

•

3 min read

Security doesn't fail in silos — it fails in cascades.

The cascades everyone's writing about are between companies. The ones that take you down are inside yours. One weak domain. Nine downstream failures. Most security teams can't see the shape.

Michael Faas