Building at the intersection of
security and intelligence.

What I believe

Security is a knowledge problem before it's a tools problem. You can't defend what you don't understand — which means the best security engineers are compulsively curious about how systems fail.

AI changes this calculus in ways most security frameworks haven't caught up with yet. When the model is the attack surface, threat modeling requires new primitives: probabilistic behavior, unbounded input space, training data as supply chain. I'm interested in building the tools and frameworks for that world.

I think the most important security work happens at the design layer, not the incident response layer. Shift left isn't a slogan — it's the difference between prevention and cleanup.

Origin

My legal name is Marquos Zaki. I go by Markus. I'm Coptic Egyptian by heritage, Canadian by address, Ottawan by habit. The name travels between cultures the same way I do — carrying both places at once.

Growing up between Egypt and Canada taught me to read systems from the outside. You notice the assumptions a system makes when you're not quite its intended user. That instinct turned out to be useful in security.

What I'm building

TMAV AI — AI-assisted threat modeling for security teams who need to move faster without trading away rigor. The system does the structured thinking; the engineer does the judgment.

ElderBridge — Connecting aging parents and their families through gentle, dignity-first check-ins. A project that started from watching someone I love navigate this problem alone.

This site — writing as a practice. Putting ideas in public because the alternatives (keeping them private forever, or never finishing them) are both worse.

What I'm not

Not a credential collector. Not a vendor. Not trying to be the loudest voice in the room. Not interested in security theater. Not available to "pick your brain" without context.

For everything else: writing, newsletter, or find me on LinkedIn.