Research and published work

Research interests

• Cybersecurity architecture and Zero Trust adoption in enterprise environments
• Cloud security, landing zone governance, and multi-cloud risk management
• AI security, AI governance, and the secure adoption of enterprise AI services
• Network security architecture and segmentation strategy
• Security operations effectiveness in resource-constrained organizations
• IT governance, compliance, and risk management in regulated industries

Research and writing on this site

Longer-form technical research published here directly. Each is a self-contained reference: a canonical model, the decisions behind it, the controls it depends on, and the limits of what it claims.

• HIPAA Security Architecture for AI-Assisted Clinical Documentation — Reference and Assessment Method

  Reference security architecture and HIPAA assessment method for an AI-assisted nursing documentation platform: PHI lifecycle mapping across twelve locations, six-boundary trust analysis, transient versus persistent processing, temporary-audio failure paths, the model processing boundary, the business-associate chain, tenant isolation, PHI-minimized logging, deletion reach, and a Security Rule crosswalk verified against the current regulation.

  Published September 8, 2026

• Forward Deployed Engineering — Reference Architecture and Operating Model

  An authored reference architecture and operating-model analysis for forward deployed engineering: the deployment boundary problem, a six-layer architecture with two cross-cutting concerns, deployment topologies, engagement lifecycle, AI production pipeline, GraphRAG limits, Zero Trust access boundaries, anti-patterns, productization economics, maturity model and standards alignment.

  Published August 9, 2026

• Securing the Model Context Protocol as an Enterprise Control Plane — Architecture Reference

  Reference architecture for governing AI tool access: MCP trust boundaries, threat taxonomy, delegated identity without token passthrough, deterministic policy gates, execution isolation, control-plane discipline, standards crosswalk and a phased roadmap.

  Published August 8, 2026

• Brokerage Connectivity and Token Resilience Platform — Architecture Reference

  Sanitized architecture reference for a multi-region brokerage token-resilience control plane: component model, connection state machine, fenced refresh sequence, capability matrix, failover rules, threat model, test matrix and runbooks.

  Published August 8, 2026

• NYDFS Part 500 and AI Readiness — Assessment Artifacts

  Interactive assessment artifacts from a sanitized NYDFS 23 NYCRR Part 500 and AI cybersecurity readiness engagement: requirements matrix, AI risk crosswalk, evidence model, prioritization model and remediation roadmap.

  Published July 29, 2026

• Microsoft Teams Phone — Design Reference

  Working design reference from a Microsoft Teams Phone implementation: PSTN connectivity comparison, call-flow design, Auto Attendant and Call Queue configuration, dial plans, emergency calling, QoS, test matrix and a troubleshooting runbook.

  Published July 29, 2026

• Interactive Enterprise Modernization Architecture — Canonical Model, Controls, Decisions and Roadmap

  Interactive enterprise modernization architecture: one canonical model driving fifteen linked views, an asset-mapped control catalog, architecture decision records, a risk register and a phased runbook. Reverse-engineered from a modernization guide; assumptions are labeled.

  Published July 25, 2026

  Documents in this package

  • Implementation and Operations Runbook
  • Principles and Architecture Decisions
  • Security and Threat Model
  • Source Traceability
  • Integration Catalog
  • Risks, Assumptions, Constraints and NFRs
  • Data and AI Governance
  • Operations and SRE

• AI-Driven SOC Platform — Interactive Target Architecture

  Interactive reference architecture for an AI-driven security operations platform: bounded agentic AI inside a deterministic, policy-controlled platform. Gap analysis, layers, agents, controls, evaluation, roadmap, runbooks, ADRs and risk register.

  Published July 25, 2026