/ˌʌnˈmɪtɪɡeɪtɪd rɪsk/
I’m Ryan Hurst. For more than three decades I have built systems and led organizations focused on helping people and organizations know what to trust online, from cryptography and identity to the infrastructure that connects them.
Latest in technology and leadership, , 19 min read
WebPKI certificate concentration, reliance, sovereign trust, historical CA incidents, and the quantum transition.
Read the full essay
Writing on technology, leadership, security, and life.
Eight eMudhra CA keys were small enough to guess. eMudhra had cryptographic proof in June 2025 that something was wrong, kept the weak keys in service, and no other layer of WebPKI oversight was positioned to catch it.
AI is shifting developers from producing code to judging generated output, reviving the testing skills and independent quality judgment the industry spent decades automating away.
Periodic audits cannot keep pace with changing systems. Two companion essays examine why assurance evidence fails and how AI may finally make continuous reasoning practical.
The WebPKI's cryptographic graph and governance hierarchy are different structures. Classical and post-quantum trust both depend on understanding the gap between them.
Security failures accumulate in the seams between coherent systems. The same ownership gaps explain why institutions preserve a status quo after its assumptions expire.
FIPS 140 validation can improve key isolation while forcing organizations to run opaque, outdated cryptographic software. Public validation data can turn labels into better security questions.
Certification records explain what evaluators examined, not whether the surrounding firmware behaves as assumed. Assurance must connect the paper trail to evidence from the code that shipped.
AI makes analysis abundant, but judgment still comes from owning decisions and living with their consequences. The best systems should connect analysis, action, verification, and learning.
Longer essays and research on security, identity, cryptography, compliance, and AI.
Thirty years of digital identity programs, sorted by how they actually failed, and why the half of the system that decides adoption is the half nobody funds.
Two services, one bug, every instrument calling them identical. We scaled security’s answers but never the reasoning behind them, and machine reasoning may finally change that.
How attestation audits actually function, using the WebPKI as a worked example, from management assertions and control matrices to evidence and auditor conclusions.
A field guide to what containers, VMs, confidential VMs, and enclaves actually protect, and what it costs when each one fails.
How periodic audit came to be, why its epistemic reach is shrinking, and what AI does to the mismatch.
The economics of cognition, the limits of GRC software, and what AI actually changes.
How the Internet will decide which public keys to trust once signatures no longer fit on the wire.
How the Internet decides which public keys to trust.
What the US and Canadian standard for validating cryptographic modules actually covers, with data from the validation corpus.
The story of the Dodge Power Wagon, from its wartime origins and working life to the modern truck that still carries its name.
I have been speaking at conferences since the 1990s, including RSA Conference.
These are highlights from a longer record of work across the IETF, the Trusted Computing Group, ISO, and NIST.