Sign up for F15hb0wn.com blog updates

2026 Conference Talks for Charles Herring

Charles Herring 11 December 2022
Linkboard
New for 2026: abstracts on Coding with AI (lessons from building WitFoo's analytics platform with Claude Code) and Empathetic Processing and Temporal Link Analysis (research pathways for AI in cyber defense). The classics on CyberGrid, SECOPS-as-law-enforcement, and the Seven Unstable Conversations are still on the menu. Bio refreshed for the Chairman era and the New Zealand base

Hard-Earned Trust, Automated Away

Charles Herring 3 July 2026
Hard Earned Trust Lost to Automation
Someone stood up a slick "WitFoo Authorised Partner" store selling licences we never made, and the registrar's abuse desk answered with a form letter. A look at counterfeit partner programmes, the supply-chain risk they create, and what happens when we automate away the judgement that trust actually depends on.

Fish in a Box

Charles Herring 25 June 2026
Dragon 300 on launch from USS Kitty Hawk
Twenty years ago a young sailor quoted "Fish's second rule of troubleshooting" back to me, and I realised I'd been writing rules I never wrote down. This is the story of how we used AI to inventory, argue over, and ratify the norms that run WitFoo, from "The WitFoo Way" of coding all the way out to a thing we call Fish-in-a-box.

Adversarial Code Review Example with Claude

Charles Herring 18 June 2026
Adversarial Review

Below you will find my adversarial review prompt that I give to Claude on every pull request review. This is a living document that references dozens of cascading documentation. Collectively, over 1,700 norms contained in the "WitFoo Way" are reviewed. Also, the integrity of the work done by what is often a lazy or dishonest Claude session. In spite of the rigorous testing I outlined in Coding with Claude: What I've Learned Building a Cybersecurity Platform with AI , Claude finds new innovative ways to come off the rails. I use this prompt in an independent session to find shortcuts and lies from the PR session. I have run this prompt dozens of times and it has never come back without hits.

Podcast: Adventures of Alice & Bob

Charles Herring 23 April 2026
Alice and Bob Podcast with Charles Herring
In this episode, James talks to Charles Herring about what happens when an IT wizard runs away to join the Navy, works on fighter jets, and then gets thrown into cybersecurity right after 9/11? He shares his unconventional journey from the Wild West days of network defense, complete with fighting worms with worms—to being CISO during the Target breach. Plus: why trauma creates silos, why your SOC is like throwing receipts in garbage bags, and what it takes to build a "good neighborhood" in cybersecurity.

Three Prompts That Turn Your Data Lake Into an Empathetic Processor

Charles Herring 22 April 2026
Huggingface Dataset
Earlier this week, WitFoo and the University of Canterbury released 100 million labelled cybersecurity records to Hugging Face under Apache 2.0. Here's a three-prompt walk-through for putting it to work in a stack you already own (Grafana, Sentinel, Splunk, Elastic), using Empathetic Processing to translate, detect, and visualise across your own data.
Subscribe to F15hb0wn Blog Entries