Markus Zaki
Staff security engineer in Ottawa. Builder of AI tools for people who take risk seriously. Egyptian-Canadian. Occasionally writes about things that matter.
A first-hand review of Practical DevSecOps' Certified AI Security Professional (CAISP) — how I prepared, what the exam is actually like, and whether it's worth your time if you're weighing AI security certifications.
Traditional threat modeling assumes deterministic code. AI systems break that assumption in ways most security frameworks haven't caught up with yet.
The security community has a culture of closed doors. I think that's a competitive disadvantage — for individuals and the field.
The context window size arms race misses the point. More tokens doesn’t solve the retrieval problem — it just makes it more expensive. The hard question is: what belongs in context vs. what belongs in a database?
Security theater exists because it’s much easier to measure compliance than risk reduction. You can count policies. You can’t count breaches that didn’t happen.
The best names compress a concept so densely that they change how you think about it. “Technical debt,” “rubber duck debugging,” “shift left.” Bad names make ideas harder to share. Good names make communities possible.