Same journey, new shoes

For years I’ve wanted to do this. People who know me personally tend to think I talk quite a bit ^{citation-needed}, and I’m always open for a nice brainstorming on whatever is interesting: security, architecture, philosophy..

And after those sessions I always think “wouldn’t it be amazing to put all those thoughts on a blog entry?”.

But thinking about doing something and actually doing something are two different beasts. Doing something requires far more time and effort, and those are always in short supply. Sometimes you need a shift in your life, so priorities shift with you..

.. and that’s exactly what happen to me last year 😅. Our whole family moved to Switzerland and it felt like a big reset. My job allowed me for some months of transition period, but now that I’m about to leave I thought “this is the time to show all those ideas”.

So, you might be reading this and understandably rolling your eyes 🙄, “ohhhh nice, yet another blog about cybersecurity from a guy which is looking for a job”, and you will not be mistaken 😅.

So why do I think you would still be interested in reading what I have to say? It all comes to two factors.

1. A “relaxed” take on cybersecurity

Ok, I know this one is controversial. The words “relaxed” and “security” do not play well together. In fact, while brainstorming names for this website, “chill on security” always got the feedback of “it looks you are being careless”.

Security is a serious thing! Security has to be strict, always ready to act!

The problem is that cybersecurity blogs and news are all following the same tone: the end is near! it is time to panic!

And if you read the news, you will have reasons to think that is the case. In the last months we had AI agents escaping sandboxes and hacking their way into third-party systems, PHP2shell vulnerability breaking havoc in the Internet, certificate authorities being irresponsible and generating unsafe certificates..

All feels really daunting.. and too much. Years ago these news were the way to show your management that security IS important and you must invest and do something about it. But nowadays you should not need convincing (I hope). What you need is to cool down, see what you have in your environment and start solving the boring (but foundational) issues that you surely still have on your plate.

With this blog, I want to bring a counterweight to the overall cybersecurity industry communication, for which panic and scare tactics is a good product selling strategy. Unfortunately, most of those products only work when you have your basic cyber security hygine covered, but that cannot be bought, it can only be grown.

So if you see going into the doomsday direction (as anyone else), please remind my own promises!

2. My own words, no AI generated blog posts

If you are going to spend time and read my blog, the bare minimum I can do is write it myself.. which, yes, it feels hard and slow.

But otherwise, why would you bother staying here? I’m pretty sure you have an LLM account or subscription you can go and prompt anything you want about security.

I want this to be my authentic voice, and not a generic generated blog-post. Believe me, the temptation of going to Claude and prompting “please generate a welcome blog post entry with these 2 main talking points” is quite strong, but even doing that and modifying the outcome will not feel like mine.

Uhm, so you are one of those “AI is bad” type of people?

Not really, in fact this whole site has been generated using Claude (using Astro and Cloudflare, I will write a blog entry on that soon).

I think AI is great at assisting you in those places where you just need to fill the blanks, because that is not your added value. But if I was a web designer, I would make sure the site would be something original that cannot be generated in a single afternoon of prompting (right now, it is generic as it can be, which is fine for my purpose).

So my promise to you is that blog entries will be written by hand (and eventually consumed by an LLM model, so someone else can impersonate my style as well 😅).

Notice: While the posts are written by me, probably many of the images I use will be generated by AI.. I said “written”, not “drawn”.. you don’t want to see me drawing 😝

Putting on the shoes

So if I caught your interest, bear with me and I hope you will get some good take-aways from my own journey.

And of course, any feedback is appreciated!

More details of my background in About me.

Written by Marcos Garcia ChillonIndependent cyber-security consultant, working with teams across Europe. More about me