Blog

Ideas on AI security & self-hosting

Original, practical writing on running AI on your own infrastructure — security, privacy, compliance and cost.

Security8 min

Security Logging: What to Keep, for How Long, and What to Ignore

Log everything is a storage bill, not a strategy. The signals investigations actually use, and sane retention for each.

Jul 26, 2026

AI Infrastructure8 min

Choosing GPUs for AI Inference: A Buyer's Reality Check

VRAM, not FLOPS, decides what you can run. A plain guide to sizing GPU hardware for self-hosted models.

Jul 25, 2026

Engineering8 min

Backups That Survive Attackers, Admins, and Bad Luck

Most backup strategies are tested by disaster and fail. Designing for the three ways backups actually die.

Jul 24, 2026

Engineering8 min

Container Security Essentials: Beyond 'It Works on My Machine'

Containers changed deployment; they did not repeal security. The practical hardening layers for production Docker.

Jul 23, 2026

AI Security8 min

Prompt Injection: The Web's New Untrusted-Input Problem

LLM apps keep repeating the mistakes web apps made twenty years ago. How injection works and the defenses that actually hold.

Jul 22, 2026

Compliance8 min

Audit Logging Done Right: The Record You'll Be Judged By

Audit logs answer 'who did what, when' — for investigations, compliance and accountability. What makes an audit log trustworthy rather than just voluminous.

Jul 22, 2026

AI Security8 min

Governing the Data You Send to AI: LLM Data Flows You Can Defend

The moment employees use AI assistants, company data starts flowing to models. Governing what goes where is the new data-protection frontier.

Jul 22, 2026

Engineering8 min

SSH Hardening: The Checklist That Blocks 99% of Drive-By Attacks

Every internet-facing server gets brute-forced within minutes of boot. Fifteen minutes of SSH configuration ends the conversation.

Jul 21, 2026

Engineering8 min

Infrastructure as Code: Security's Best Friend and Newest Risk

Defining infrastructure in code makes environments consistent and auditable — and turns a single misconfiguration into a repeatable one. How to get the upside safely.

Jul 21, 2026

Compliance8 min

Data Classification: You Can't Protect What You Haven't Sorted

Not all data deserves the same protection. A simple classification scheme is the foundation that makes every other security control proportionate.

Jul 21, 2026

Compliance8 min

Privacy by Design: Building Systems That Don't Become Liabilities

Privacy regulation punishes collecting and mishandling personal data. Designing for privacy from the start is cheaper, safer and increasingly non-optional.

Jul 21, 2026

Security8 min

Zero Trust for a Ten-Server Fleet: The 20% That Delivers 80%

Zero trust is not an enterprise shopping list. The handful of practices that give small fleets most of the benefit.

Jul 20, 2026

Engineering8 min

TLS Certificates, Explained: What the Padlock Actually Promises

HTTPS is everywhere and understood by few. What certificates prove, what they don't, and the operational traps that cause outages.

Jul 20, 2026

Engineering8 min

What's Actually in Your Container? The Case for Image Scanning

A container image bundles your code with an entire stack of dependencies — and their vulnerabilities. Scanning is how you find out what you're shipping.

Jul 20, 2026

Engineering9 min

Rate Limiting: The Cheap Control That Stops Expensive Abuse

Brute force, scraping, credential stuffing and cost-draining abuse all rely on volume. Rate limiting caps the volume — and it's one of the highest-return controls you can add.

Jul 20, 2026

Incident Response8 min

Ransomware Hit at 3 A.M.: A Calm Guide to the First 24 Hours

What you do in the first day decides whether ransomware is an incident or a catastrophe. A step-by-step order of operations.

Jul 19, 2026

Security8 min

What to Log, How Long to Keep It, and Why It Matters When It's Too Late

After a breach, logs are your only witness. A practical guide to logging enough to investigate without drowning in noise or cost.

Jul 19, 2026

Engineering8 min

API Security Fundamentals: The Attack Surface You Exposed on Purpose

APIs are doors you deliberately opened to the world. The core practices that keep them from becoming the easiest way in.

Jul 19, 2026

Platform8 min

Monitoring That Actually Catches Problems (Before Your Users Do)

Collecting metrics is easy; getting alerted about the right things at the right time is hard. How to build monitoring that warns you early without crying wolf.

Jul 19, 2026

Platform8 min

Running an AI Chat On-Prem: Workflows Without the Data Leak

Teams want ChatGPT-style productivity; counsel wants nothing sensitive leaving the network. You can have both.

Jul 18, 2026

Incident Response8 min

The Incident Response Playbook Every Small Team Should Have

When a breach hits, improvising under pressure goes badly. A simple, pre-written playbook turns panic into a sequence of known steps.

Jul 18, 2026

Incident Response8 min

Tabletop Exercises: Rehearsing the Crisis Before It Arrives

A tabletop exercise is a low-cost, high-value way to test your incident response without a real incident. How to run one that actually finds the gaps.

Jul 18, 2026

AI Infrastructure8 min

Taming the GPU Bill: Practical Cost Optimization for AI Workloads

GPUs are the expensive heart of modern AI, and idle or mis-sized ones burn money fast. Practical levers to cut inference and training costs without cutting capability.

Jul 18, 2026

Security8 min

Threat Feeds Are Cheap. Using Them Well Is Not.

A list of bad IPs is not intelligence. Matching, aging, and context turn feeds into detections that matter.

Jul 17, 2026

Security8 min

Phishing Defense That Doesn't Rely on Perfect Humans

Awareness training helps, but people will always click sometimes. The layered technical defenses that catch phishing before and after the click.

Jul 17, 2026

Security8 min

Patch Management: Boring, Unglamorous, and Where Most Breaches Are Won

A large share of successful attacks exploit vulnerabilities that were patched months earlier. A realistic patching process beats a perfect one you never run.

Jul 17, 2026

AI Infrastructure8 min

Local Models vs API Calls: An Honest Trade-Off for Sensitive Work

Running an LLM on your own hardware or calling a hosted API is a real engineering decision with security, cost and capability trade-offs. A clear-eyed comparison.

Jul 17, 2026

Security8 min

Beyond Passwords: Why MFA Is the Single Highest-Value Control

Most breaches start with a stolen credential. Multi-factor authentication blunts the entire class of attack — but not all factors are equal.

Jul 16, 2026

Security8 min

Network Segmentation: Containing the Blast Radius Before It Happens

A flat network turns one compromised device into a foothold on everything. Segmentation is how you make sure a breach stays small.

Jul 16, 2026

AI Security8 min

Retrieval-Augmented Generation: The Security Questions Nobody Asks First

RAG lets an AI answer from your own documents — which means your access controls, data freshness and injection risks now live inside the AI.

Jul 16, 2026

Compliance8 min

Compliance Automation: What Tools Can Do and What They Cannot

Evidence collection automates beautifully. Judgment does not. Where compliance tooling genuinely saves months.

Jul 15, 2026

Platform8 min

Monitoring the Machines You Forgot: Lightweight Edge Agents

The forgotten VPS is the attacker's favorite server. How low-footprint agents keep the long tail of your fleet honest.

Jul 13, 2026

Engineering8 min

Stop Putting Secrets in .env Files: A Practical Vault Primer

API keys in plain text are one git push away from disaster. The minimum viable secrets discipline for small teams.

Jul 11, 2026

Engineering8 min

Routing AI Jobs Across GPU Clusters: Five Lessons From Production

Multi-provider AI routing sounds simple until the first regional outage. What we learned building Orchestra.

Jul 9, 2026

Security8 min

A Security Operations Center for Teams of One

You do not need a 24/7 analyst room to run SOC discipline. You need triage, evidence, and escalation — automated.

Jul 7, 2026

Platform8 min

BYOK: Why Bringing Your Own AI Keys Is the Sanest Way to Adopt AI

Vendor-managed AI means vendor-priced AI and vendor-visible data. Bring-your-own-keys flips the power balance back to you.

Jul 5, 2026

Security8 min

Behavioral Threat Detection, Explained Without the Buzzwords

Signatures catch yesterday's malware. Behavior catches today's. How baseline-and-deviation detection actually works in practice.

Jul 3, 2026

Security8 min

Why Self-Hosted AI Security Beats the Cloud for Sensitive Workloads

Zero data exposure is not a slogan — it is an architecture. What actually changes when your threat detection runs on your own servers.

Jul 1, 2026