Cross-section illustration of a medieval castle's concentric defences seen from above at a slight angle: moat, outer wall, gatehouse, courtyard, inner keep

The phrase survived. The definition did not.

Consider a medieval castle. It is tempting to imagine that its security rested on the thickness of its walls, and that a besieging army faced essentially one problem, repeated: get past the stone. But that is not how a defended position worked, and the people who built them knew it. A castle was arranged so that every successful advance exposed the attacker to a new disadvantage. The moat forced engineering work under fire. The wall forced escalade or breach, both slow, both loud, both costly in men. The gatehouse compressed the attackers into a killing corridor where their numbers stopped helping them. The courtyard beyond it was overlooked from every side, so that taking the gate meant standing in the open beneath defenders who had been waiting for exactly this. And the inner keep meant that even total success outside its walls bought the attacker another siege, on worse ground, with a depleted force. ...

July 21, 2026 · 10 min
admin attack surface

The administrative attack surface

A few days after sending an application to the Dutch Ministry of Defence for a senior cyber and information security advisory role, I read an NRC article about publicly accessible details of Dutch military infrastructure. Not leaked documents. Not espionage. Not shadowy dead drops in rainy parking garages. Public websites. Pipeline routes. Radar dependencies. Cable maps. Technical drawings. Backup systems. Segmentation details. Power feeds. Coordinates. Bits of information scattered across agencies, permits, infrastructure registries, environmental datasets and planning portals like breadcrumbs dropped by a committee convinced that nothing bad ever happens in spreadsheets. ...

May 6, 2026 · 5 min