Explore cutting-edge cybersecurity insights and protective strategies with John Menerick. Deep dives, threat analysis, and live streams from securesql.info.
About John Menerick
Most security programs assume more tools and more operators will keep pace with an ever-expanding attack surface. John Menerick believes that assumption is wrong.
With 11+ years securing Fortune 500 financial institutions, tech companies, startups, and public-sector organizations, John treats defense as a complex adaptive system — one that senses, responds, and evolves. He draws on complex systems science (TAME, TOTE, Ashby’s Law of Requisite Variety) to engineer security architectures that self-correct under pressure, spanning application security, detection engineering, zero trust, cryptographic protocol design, zero knowledge, cloud security, and AI/ML security.
Proof of work: Built Gyoithon (ML-driven pentesting framework), published two whitepapers on agentic defense, reduced MTTD from hours to minutes at a Fortune 500, designed zero trust across 40K+ endpoints, mentored 78+ junior engineers, and maintains open-source tools (ThreatPlays, IRKnowledge, IntelMetrics) used by the security community. Amateur Extra Class radio license (W8MEJ).
Models the problem before reaching for a tool. Maps feedback loops, failure modes, and emergent behavior before writing a single rule.
Builds what doesn’t exist. Built Gyoithon and IntelMetrics when the tooling wasn’t there. Ships solutions, not vendor evaluations.
Operates at both altitudes. Moves between executive architecture conversations and hands-on code review, packet captures, and IR.
Teaches by doing. Pairs on incidents and co-authors detections with junior engineers.
Defaults to transparency. Publishes research and open-sources tooling.
Perspective
Q: How do you apply complex systems theory to security engineering?
A: Threat landscapes are nonlinear — attackers adapt, environments shift, controls interact unpredictably. I use Ashby’s Law of Requisite Variety to ensure defensive systems match the adaptive capacity of threats. Practically: detection pipelines with self-tuning feedback loops, architectures where subsystem failure doesn’t cascade, and security operations treated as a living system rather than a fixed-state machine.
Q: What’s missing from how most organizations approach security engineering today?
A: Three critical things. First, most organizations optimize for compliance rather than resilience, failing to account for the perceived singularity acceleration of the cat-and-mouse game. While defenders are checking boxes for annual audits, threat actors are leveraging automated exploitation and AI-driven reconnaissance to compress the attack lifecycle toward near-zero. We aren’t just fighting hackers; we’re fighting an exponential curve.
Second, there is a massive velocity gap caused by an underinvestment in the “engineering” of security engineering. Organizations buy tools that are static by design, while the threat landscape is fluid. Without building the automated connective tissue—real-time telemetry pipelines and self-healing response workflows—you’re bringing a manual process to a machine-speed fight.
Finally, we fail to treat technical security as a high-concurrency distributed systems problem. To survive the acceleration, security can’t be a gate; it has to be a set of algorithmic guarantees. You need systems that provide consistency and graceful degradation under fire, effectively creating a defensive “OODA loop” that can programmatically outpace the adversary’s evolution.
