Aurora

Three things that came up on the panel that I keep turning over. First: The China+1 thesis is not a strategy anymore. It’s a starting point that now requires a China+1+1 to actually work. Vietnam and Malaysia are in the same USTR investigation as China. Companies three years into a supply chain transition are facing round two. Second: Nobody on stage disagreed that Hormuz is the defining near-term story for APAC business. But most corporate risk frameworks treat it as a trade story. It’s not. It’s an energy security story with a direct line to inflation, reserves, and operating costs across the entire region. Third: The defense rearming happening across APAC — Japan, South Korea, Australia, India — is moving faster than compliance programs. Dual-use technology exposure is a growing blind spot for companies that don’t think of themselves as defense-adjacent. None of these are predictions. They’re current conditions. The gap between what boardrooms think the operating environment looks like and what it actually looks like is where decisions go wrong. #GeopoliticalRisk #SupplyChain #APAC #SecurityLeadership #BusinessContinuity

On stage today at the Analyst Roundtable All Hands, hosted by Visa . Most APAC risk conversations happen at 30,000 feet. I try to operate at ground level. What does a maritime incident in the South China Sea actually trigger for your people and operations? What does a 3-to-6-month Hormuz closure mean for a business continuity plan written when energy was cheap and shipping lanes were open? These are operational questions with real impacts, in addition to the geopolitical aspects. That's the conversation I'm having today. What's the APAC risk question your organization hasn't answered yet? #CorporateSecurity #CPP #RiskManagement #APAC #PanelDiscussion

In 2024, a security researcher spent six weeks building a professional relationship with a colleague named "Alicia Chen." Stanford MBA. Mutual connections. Thoughtful messages. She remembered details from previous conversations. She asked smart questions about his work. She did not exist. "Alicia Chen" was a synthetic persona — an AI-generated identity with a fabricated photograph, a constructed professional history, and a conversation engine that could maintain a credible relationship for weeks before making a single ask. The honey trap is one of the oldest techniques in intelligence tradecraft. Soviet doctrine called it Medovaya Lovushka. The KGB ran it as a systematic program with trained operatives, scripted escalation protocols, and defined extraction objectives. In 1975, running a honey trap required a trained human operative and months of patient relationship development. The scalability was limited. The operational overhead was significant. In 2026, it requires a laptop and an afternoon. Your executives are on LinkedIn right now. Your board members are accepting connection requests. Your vendor qualification process has no identity verification step. The relationship is the weapon. It always was. Full piece in comments — what synthetic personas mean for your security program, your board, and the vendor you are about to onboard.