Coming October 20, 2026
Built Wrong
Why Cybersecurity Keeps Failing and How We Can Rebuild It
Read more →
Writing
Three books, a live cyber loss tracking index and dozens of authored pieces.
The writing comes from experience in the seat and researching the paradoxes and hidden truths in cybersecurity. From lighthearted stories about personal growth to the co-authoring of security standards and industry position papers, the focus is always on discovering truth and sharing it.
Launch updates
Built Wrong arrives on October 20, 2026. The Kindle edition is open for pre-order now. Leave an email and I will tell you when it ships.
An email address and nothing else. You confirm it before anything is sent, and every message carries an unsubscribe link that works. What this list is.
"Built Wrong" is a book filled with uncomfortable truths. I'm sure that it will anger quite a few people, but hopefully it will open the eyes of even more.
John KindervagCreator of Zero Trust
The index
The Hacker in a Hoodie Index
A wholly unique live public record of what individual cyber incidents actually cost. Every figure is read from the document that reported it and graded by how well it is attested. The figures are never summed into a total, because within that total are dollar amounts and types that can't simply be added together. Doing so would create a manufactured figure that reflects a loud headline number, but not the truth of the losses, who they impacted and how.
Most recently added
- Oct 17, 2026
Napoleon Perdis: not yet quantified
Attested figure. Not yet quantified, disclosed Oct 2026, Retail and Consumer. Napoleon Perdis lost names, birthdates, addresses, phone numbers, and purchase histories for roughly 339,055 customers through Retail Express, the vendor it paid to store them, where an unauthorized party had access from November 2025 to June 2026. Neither company has said how the intruder got in. Seven months of undetected access sat in a system the cosmetics brand did not run and could not watch. No card data was stored, the notice stresses. Only birthdates and home addresses, which no bank can reissue. The investigation into the incident was 40% faster than the time it took to discover the breach in the first place. Source: Napoleon Perdis data breach affects 340,000 of the cosmetics company's clients.
Retail and Consumer - Oct 16, 2026
Inner City Education Foundation: not yet quantified
Verified figure. Not yet quantified, disclosed Aug 2024, Public Sector and Education. An unauthorized actor sat inside Inner City Education Foundation's systems from August 4 to September 29, 2024, and may have copied files; the disclosure took two years to arrive. The filing never says how they got in, who they were, how many people are affected, or what data was taken. The assurance that no fraud has been seen comes from the organization that didn't see the intruder for eight weeks and didn't report the incident for 2 years. A bold claim for an organization that didn't see much of anything for 26 months. Source: California AG breach notification.
Public Sector and Education - Oct 16, 2026
California Department of Education: not yet quantified
Verified figure. Not yet quantified, disclosed May 2026, Public Sector and Education. From May 22 to September 18, someone with one compromised login copied files from ETS, the testing contractor holding California's student data; nobody has said how the credential was lost. The department counts names, addresses, demographics, and disability status for all 7 million students from three school years. One login stood between a single vendor server and a state's children. No Social Security numbers, officials stress, as if disability status could be reissued. Source: California AG breach notification.
Public Sector and Education - Oct 16, 2026
John G. Yphantides, a Professional Law Corporation: not yet quantified
Verified figure. Not yet quantified, disclosed Oct 2026, Professional and Business Services. John G. Yphantides, a Professional Law Corporation, lost data to a confirmed theft, and the October 2026 attorney general filing omits the entry point, the window, the record count, and the type of data taken. Qilin listed the firm on its leak site and claims to have stolen internal data. A law firm is a concentration point for other people's secrets, and the filing never says what guarded those secrets and failed. Source: California AG breach notification.
Professional and Business Services - Oct 16, 2026
BAE Systems: not yet quantified
Attested figure. Not yet quantified, disclosed Oct 2026, Technology and Software. A cybersecurity incident at BAE Systems knocked out the Bankruptcy Noticing Center it runs for the Federal Judiciary, halting bankruptcy notices for every federal bankruptcy court nationwide. The judiciary has not said what happened, when it began, or whether any data was accessed or taken. Every bankruptcy court in the country shared one failure domain, and it belonged to a contractor. Source: BAE Systems cyberattack disrupts US federal court operations.
Technology and Software
The books
Coming soon
The Verified Security Framework
The Operating Manual for Built Wrong: Why Cybersecurity Keeps Failing and How We Can Rebuild It
Published 2024
Famous With 12 People
A Career Guide On How To Be An Internationally Recognized Expert In Something Nobody Cares About
Read more →