via RSS

My kids spot AI art from miles away, a lot better than I can. Sometimes they can explain why the art is AI (and they are right), but sometimes they just feel something is off. My kids despise AI generated art, find it 'creepy' and 'soulless', turn away in disgust and look down at the publisher. This is not my teaching, they bring this home from school.

Thinking through how genAI works, it generates patterns along the lines of what humans do. AI 'averages' our collective output into something that could be relevant for the input prompt. What it regurgitates might not have existed before 'as is', but it is not going to be original or radically new.

Sometimes mediocre is enough. Sometimes you just want an image of a smart looking businessman (or woman) talking on the phone on the right side of your slide, because you don't want it to be empty. (I hate such distractions, I prefer empty.) AI can generate a 'consistently strong' image of businessman (or woman) for you, and can do it cheaper and faster than any human could.

Art should say something original, and AI is never going to cut that. This won't get better in next release, won't be patched, this is the nature of how it works. The prompt can be original, but the text/image/video the AI outputs is merely aggregating/combining what is already out there.

AI art can sometimes fool me, and tomorrow's tech may fool me even more. I am glad the next generation (or a part of it) keeps an eye out, has learned to spot it and has a very strong opinion.

I don't think AI would ever replace a real artist in a real art job. It does replace the craftsman who draws yet another cute looking animal, and it may eliminate such craftsmanship jobs. Real art jobs it will never replace.

This post was first published on Linkedin here on 2026-09-06.

I have obtained the ISC2 Building an AI Strategy cert.

The program is designed with CISOs and security leaders in mind, focusing on enterprise governance, risk management, and on setting up & running an AI security program, rather than deep diving into code or math details.

The real value of ISC2 programs like this is bringing security professionals onto common ground with awareness of the capabilities of bad actors and a unified vocabulary. It is not about the latest news or cutting edge tech; if you follow what the security industry is doing, you are unlikely to hear anything game breaking.

This was a solid experience overall, and I both enjoyed it and benefited from it.

This post was first published on Linkedin here.

Is it just me or do you also get locked out of your accounts nowadays? This almost never happened before, but I more and more often end up in 'authentication hell'. 👿

At the dawn of time there was nothing but passwords. They were sniffed/brute-forced/phished, etc.

Then came multi-factor authentication (MFA). A password manager with an authenticator app as second factor made life livable - at least for us, security geeks.

Logging in is an 'adventure' nowadays. 🤠 You never know what to expect:

• Weird password restrictions (min 12 chars, but not more than 16; have at least a special character but not ' or "; must use numbers but not consecutive ones, their sum cannot be prime)

• MFA, of course

• In addition to passwords, we now have passkeys/PINs (sometimes numeric, sometimes not) which you have to set device-by-device; some apps use the device's own passkey but some have their own and must be different

• Sometimes there is no password, enter a one-time code via SMS. Or e-mail.

• Sometimes you must use their app

• Sometimes the app randomly decides to take a photo of you. Or a video where you say 'cucumber'. Of course it does not recognize you.

• Fingerprint? Signature?

• Stupid security questions (first pet's name), sometimes mandatory for logging in

• For some actions you must use an Apple device. Or Google device.

• If you enabled parental controls, this all doubles: one for the kid, one for the parent

• Sometimes you get redirected to a social media account which just decided that you must add your phone number and change your password (see above) to proceed

• Sometimes more than one of the above are used, but always in a different order, especially in case of Microsoft

I understand the reasons for all this. A real human being just cannot manage passwords which are secure today, and bad guys have figured out how to trick MFA users.

1. 'Non-Phishable' authentication - use local-only credential, so if a bad guy steals it, it is of no use --> but having to manage device-specific or app-specific passwords and forfeit SSO? come on!

2. Risk-based - Paying your phone bill like you do every month should be simple! Logging in in the middle of the night from an IP in Latveria and trasferring all your savings? - scrutinize!

3. Identity-providers - While this should simplify things, it results in redirects (which may break), ending up at another company/organization not related to the service you want to use.

We preach of educating users, but we are training them to follow any random, intrusive security process. You can no longer write a guide, or cannot explain a grandma how to log in as it will be different next time. Just follow instructions.

I get it, there are reasons and the landscape is evolving and the dust will settle.

Security folks, I understand the good intentions, but this user experience is getting unacceptable.

This post was first published on Linkedin here on 2026-07-11.

Frank Herbert is known for his Dune books, but he has some other phenomenal work. In his novels Whipping Star and The Dosadi Experiment the sentient species of the galaxy live under a government so efficient that it passes laws and enforces them galaxy-wide in mere seconds, and such reckless legislation has made the world a horrible place to live in. To limit the power of the hyper-efficient government, the sentient species established the fourth branch of power: the Bureau of Sabotage (BuSab) whose role is to hinder the government by playing dirty tricks on it.

I am less into laws, more into corporate security policies. They are needed for the security audits, but require LOTS of paperwork. Why don't we use AI 🤖 to create, review, process and maintain all those security policy documents? Humans won't need to bother with the policies at all!

Sure, we can generate/update thousands of pages of policies with AI. Still, there is something fundamentally wrong with the above approach; not with AI writing policies but with humans not knowing them.

Why do we have corporate security policies at all? They:

• 1️⃣ Define how the company must operate to be secure.
• 2️⃣ Serve as a basis for holding responsible those who do not comply -- this basis must be able to stand in court if needed.

Corporate (security) policies are not just papers to check compliance requirements, your company needs to operate that way. Generating thousands of pages of policies without anyone reading them and claiming you operate that way does not bode well:

• 👉 If your staff does not know your policies, your company is not going to operate according to them. The policies won't work, and your compliance claims will turn out to be lies.
• 👉 If your staff is not expected to know/follow the policies, they are not going to be enforceable in court.
• 👉 You will be responsible and there will be no one else to blame.

Of course you can generate/update/maintain corporate policies with AI, it does not matter who does the heavy lifting. However, if you distance them from humans and the actual processes, the policies will become dead weight, and you should not be passing those audits either.

I agree that corporate (security) policies tend to get out of control. However, generating them via AI is not the solution: that will bloat them further and further, and lead to the kind of reckless legislation in Herbert's sci-fi novels.

Use common sense and make them lean instead -- with or without automation. Identify what your employees really need to know, and make sure they follow that. Eliminate the rest. The 'delete' key is often the most useful one on the keyboard. 😄

This post was first published on Linkedin here on 2026-05-31.

I made a rather rookie mistake.

I decided to create an AI tool for gathering and organizing security news to help stay on top of what is going on. I wrote a 'serverless' Google Cloud function to run on a regular basis, invoke an AI prompt to gather those security news from the past x weeks that I am interested in, organize them into categories, summarize them, and put summaries and links on a web page so that I can review them. All worked well. ✅

...until I noticed that some of the links were broken. Further investigation showed that almost none of the links worked properly, they were broken, pointed to non-existing paths, or to example.com. The problem was not with the links, but with the news. All hallucinations. 🦄🐲👾

Having spent some time refining my prompt, experimenting with multiple AI models and learning techniques for 'grounding' the model, I realized:
The whole thing was a very bad idea.

If you ask AI to gather news, it will 'want' to give you lots of news. To please you, it will even invent some. That is the way it works. There are techniques to tune the model's 'temperature', push the model to ground the results and force it to provide evidence that they exist, you might be better off with a more advanced model or one trained more recently, but no matter what you do it may hallucinate. That is the way it works.

AI can do wonders when processing data🤖🌈 or for summarizing the past, but telling an AI to go and gather fresh news from the past x weeks is a bad idea (at least with today's tech). You need to gather this kind of data then you can make AI filter/process/organize it -- this seems to be the only way to get rid of hallucinations.

This post was first published on Linkedin here on 2026-05-10.

More entries...