I’m the CISO of a large publicly traded logistics company. That means I’m responsible for security and have authority over nothing. Authority is what you need to prevent a breach. Responsibility is what you need to be blamed for one. The company gives each to a different person so they never meet. It started when our CEO came back from a conference in Las Vegas carrying a tote bag and the word “agentic.” He’d learned it on the plane, from a magazine article sandwiched between an ad for a watch and an ad for a steakhouse. He called me in and asked whether our SOC was agentic. I said our SOC was 12 people in a room with no windows. He asked whether those people were agentic. I said they had agency in the sense that they could quit. He wrote “agentic?” on a sticky note and stuck it to his monitor. It stayed there for 9 months, curling slowly, like a leaf from a tree of knowledge nobody wanted to eat. The vendor was a startup I’ll call Panoptes, because their lawyers are better than mine. Their salesman was named Lance. Lance had the kind of teeth you only get from an accelerated commission structure. He brought a deck, a Gartner chart, and a bottle of wine that cost more than a Tier 1 analyst’s monthly rent, which, he pointed out, was sort of the point. The name came from a giant in Greek myth with 100 eyes. I asked Lance what happened to the giant. “Branding,” Lance said. “Your analysts can’t keep up,” he told us. “4,000 alerts a day. 67% never investigated.” “Can Panoptes investigate them?” “All of them. 100%.” “How?” He smiled. “Agentically.” The CEO, who had been invited to the meeting for exactly this word, nodded so hard his sticky note fell off. Gartner’s actual report said AI SOC agents should augment human analysts, not replace them, and that companies should baseline their operations and run careful pilots first. Lance’s slide showed only the curve. Our board memo cited Gartner 11 times and “augment” 0 times. Lance assured me this was standard practice. “Nobody reads Gartner,” he said. “You hang it in the lobby. Like stained glass.” The board approved it in 1 meeting. The audit committee chair asked a single question: “Does this reduce headcount?” I said it “rebalances human capital toward higher-order oversight.” He said, “So yes.” I said, “Strategically.” He wrote down “yes.” Brenda from HR handled the transition. Brenda keeps a bowl of resignation letters on her desk the way other people keep candy, and she rearranges them when she’s anxious. She called the layoffs a “talent liberation event.” 11 analysts were liberated. Each received a box, a pamphlet titled “Your Next Chapter,” and a 15-minute exit window, timed by Brenda with a kitchen egg timer shaped like a chicken. One of the 11 was Dana. Dana had been with us 9 years. Dana knew the payroll server talks to an IP in Bucharest every Tuesday at 2 a.m. because of a vendor contract from 2017 nobody ever cancelled. Dana knew which alerts were weather and which were wolves. I asked her to document this “tribal knowledge” before she left. She asked how long she had. Brenda checked the chicken. “11 minutes.” Dana wrote one line on a sticky note and handed it to me. It said “Good luck.” I stuck it next to the CEO’s “agentic?” Together they remain the most accurate strategy document this company has ever produced. We kept 1 human to watch the AI. His name is Tyler. He’s 24 and was an intern until Brenda changed his title to “Human on the Glass” and printed it on a nameplate. Human in the loop is the old model, where a person makes decisions. Human on the glass means a person watches decisions being made, like a child at an aquarium. Tyler’s glass is a monitor in a converted supply closet that still smells of toner. On his first day Tyler asked what to do if the AI made a mistake. I told him the AI makes “dispositions.” He asked what to do if it made a wrong disposition. I said escalate. He asked to whom. I said the AI. He wrote that down. He’s a good kid. That’s what made him useful. We also kept Walt. Nobody decided to keep Walt. Walt has been a senior security engineer since 2011 and hasn’t completed a task since 2014. He survives every reorganization the same way: no metric can detect him. He opens no tickets, closes no alerts, and attends every meeting holding a coffee cup that has been empty since the Obama administration. When Panoptes scanned the org chart for “automatable roles,” it flagged everyone except Walt. It couldn’t find anything he did to automate. On Day 1, the dashboards turned green. Mean time to resolve dropped from 4 hours to 3 minutes and 40 seconds. I put it on a slide in 72-point font. The CEO asked how it was so fast. I explained that the agent reads each alert, gathers context, writes a calm, articulate paragraph explaining why the activity is consistent with normal business operations, assigns itself a confidence score, and closes the ticket. He asked whether closing a ticket means the problem is solved. I said closing a ticket is how we measure that the problem is solved. He said that sounded circular. I said all the best metrics are circular. It keeps them from tipping over. The paragraphs were beautiful. Our analysts used to write ticket notes like “fp, known scanner, closing.” Panoptes wrote prose. It used the word “corroborates.” Reading a Panoptes investigation felt like being reassured by a very expensive doctor with a soothing voice. You didn’t check the diagnosis. You just felt grateful that someone with that vocabulary was in charge. Then the invoice came. Panoptes billed per investigation. Lance had described our annual allotment as “more than you’ll ever need,” which in enterprise software means “the amount you’ll exceed in month 2.” 4,000 alerts a day is 120,000 investigations a month. We ran out in 19 days. The overage rate was in an appendix. Appendices are where vendors keep the truth, the way old houses keep the furnace. The CFO asked why the AI cost more than the people it replaced. I called Lance. Lance said our company was “alert-rich” and suggested we “become alert-efficient.” So I turned off 60% of our detection rules. Impossible travel. Suspicious mailbox rules. New OAuth consents. The noisy ones, which fire constantly because attackers and executives behave almost identically. Alert volume dropped 82%. I presented it to the board as “AI-driven noise reduction.” Technically the AI didn’t do it; I did it, to save money on the AI. But the AI was in the sentence, and the slide had a green arrow pointing down, and a board loves a green arrow pointing down even more than one pointing up, because it suggests that somewhere, something got cut. Risk went down too. Our risk register calculates exposure partly from open alert volume. Fewer alerts, less risk. I didn’t design that formula. I inherited it, like a haunted house, and learned to love the noises. Walt noticed. Walt notices everything; he just never does anything about it. He leaned into my office, empty cup in hand. “You turned off the alarm to save on the smoke detector subscription,” he said. I said that was an oversimplification. “It’s a simplification,” Walt said. “The ‘over’ is you.” Then he went to lunch. It was 10:40. Now the part I’m proud of. A few years ago the SEC charged a CISO personally after a breach. Every CISO in America read that complaint the way soldiers read a casualty list. I drew one lesson from it: never be the person who decided. Before Panoptes, every closed alert had a human name on it, and every name is a witness. Now every disposition is made by a vendor’s model, tuned by a contractor’s rules, authorized by a board resolution, and watched by a 24-year-old in a toner closet. Accountability has been spread so thin you could butter the whole company with it and still see the bread. Panoptes advertises “glass-box explainability.” Every decision comes with a reasoning log, stored for 400 days in a bucket nobody has ever opened. Explainability works like a will. It matters that it exists. Nobody wants to read it while you’re alive. In the spring, the agent closed an alert on the CFO’s mailbox. Someone had created an inbox rule forwarding any message containing “invoice,” “wire” or “banking details” to an external address. Panoptes investigated. It noted the CFO had recently traveled to Singapore. It noted the external domain was 3 days old but “closely resembles a known financial services partner.” It concluded the rule was “consistent with executive delegation patterns.” Confidence: 94%. Disposition: benign. Time to resolve: 2 minutes, 11 seconds. It was one of the rules I hadn’t disabled. Panoptes caught it perfectly. It just decided it was fine. The forwarding ran for 11 weeks. We learned about it from our largest customer, who called to ask why they had paid 3 of our invoices into a bank account in Lithuania. Their AP called our AR. AR called IT. IT called me. I called legal. Legal called outside counsel. Outside counsel called it “an event.” An event is a word that hasn’t decided what it is yet. The SEC gives a public company 4 business days to file an 8-K once it determines a cyber incident is material. Everyone talks about the 4 days. Nobody talks about the word “determines.” There’s no clock on the determination. Materiality is decided by a committee, which needs a forensic assessment, which needs a scoping exercise, which needs a firm, which needs a statement of work, which needs procurement, which needs 3 bids. We scheduled the first materiality meeting. Then a meeting to prepare for that meeting. Then a pre-read for the prep meeting. At some point the event became so thoroughly in process that it was no longer, strictly speaking, happening. We filed under Item 8.01, the voluntary one, saying we had “not yet determined whether the incident is reasonably likely to have a material impact.” We also said it had been “identified and contained.” Both are true in the sense that a fire is identified when the neighbors call and contained once there’s nothing left to burn. The incident response firm pulled the Panoptes logs out of the bucket. Their report found the agent had described the attack accurately on Day 1. It got everything right except the conclusion. The lead investigator called it the best-documented breach she had ever seen. She did not mean it as a compliment. I put it in the board deck as one. The root cause analysis needed a root cause. It couldn’t be Panoptes; we had a 3-year contract and a case study in progress. It couldn’t be me; I was writing the analysis. It couldn’t be the board; the board was the audience. It couldn’t be Walt; nobody could prove Walt had ever touched anything. Root cause: “insufficient human oversight of autonomous dispositions.” Tyler. Brenda put him on a performance improvement plan. I wrote that he had “failed to escalate a high-confidence benign disposition,” a sentence that means nothing and therefore cannot be argued with. Tyler asked who he should have escalated it to. I said the AI. He said he had, and the AI said it was fine. Brenda wrote “argumentative” in his file and moved a resignation letter from the bottom of the bowl to the top, where it would be easier to reach. Tyler reached it 2 weeks later. Then I asked for more money. The remediation plan had 3 pillars, because remediation plans always have 3 pillars, the way haunted houses always have a basement. Pillar 1: expand autonomy. Panoptes had just released fully autonomous response. The logic was clean: a human failed to supervise the AI, so remove the human and you’ve removed the failure. Pillar 2: restore detection coverage, meaning turn the rules back on, which meant a bigger Panoptes contract, which Lance gave me at 15% off a price he had raised 20%. Pillar 3: augment with expert human validation. For Pillar 3 we hired a managed detection firm that supplies “senior human analysts” to check the AI’s work, billed at 3x what we used to pay our own team. On the onboarding call, our assigned senior human analyst introduced herself. It was Dana. She asked whether the payroll server still talked to Bucharest on Tuesdays. I said I’d have to check. She said she’d put it in her notes. She billed us for the call in 15-minute increments, and I swear I heard a chicken timer ring. Panoptes published the case study: “Leading logistics company reduces alert noise by 82% and cuts mean time to resolve to under 4 minutes.” Every number is true. I presented it on a conference panel called “Lessons From the Agentic Frontier.” Afterward a CISO from a hospital system asked for Lance’s number. The CEO has a new sticky note. It says “autonomous?” The compensation committee gave me a retention bonus for “decisive leadership through a complex security event.” Walt stopped by on his way to his 10:40 lunch. “You ever look up that giant?” he asked. “The one with 100 eyes?” I said I’d been busy. “Guy sat down next to him and just talked. Real soothing. Kept talking until all 100 eyes closed. Then he cut his head off.” He looked at the Panoptes logo on my wall. “God of thieves,” he said. “Also the god of smooth talkers.” Then he went to lunch. Walt is the only person in the building who saw all of it coming, and the only one who never had to do anything about it. Somewhere in that is the entire philosophy of the modern enterprise. Walt found it in 2014. He’s been drinking from it ever since, out of an empty cup.

Omarchy has a lot of really nice keybinds, but there's a lot. The only way I remember them is if I use them, but I can't use them if I can't remember them. That's why I built Omarchy Key Promoter, which is basically Key Promoter X for Omarchy. So if you access something manually that has a set keybind - eg, typing in Chromium instead of using "Super + B" - a small toast will appear in the bottom right with the keybind you could've used instead. Also, it adheres to the keybinds on your machine, not Omarchy defaults, so if you changed any keybinds it'll still work. Repo: github.com/ForrestKnight/oma…

Press Release: delloro.com/news/ai-back-end… AI back-end switch sales surpassed front-end networks in 2Q 2026. Meanwhile, #Ethernet further extended its lead in AI back-end networks, helping mitigate supply constraints. Learn more. #AIBackendNetworks #FrontendNetworks #datacenterswitch

Air conditioning demand in extreme Texas heat pushed the ERCOT grid beyond 91 gigawatts today. Before yesterday, we had never exceeded 86 GW so this record shatters the old one. Note there was >20 GW of buffer, no energy emergency, no conservation call. #txlege #txenergy 1/