Simon Mullis

Darmok, Brown M&Ms, and the Bandwidth of Meaning

Fri, 17 Jul 2026 00:00:00 +0000

Van Halen, brown M&Ms, 1980s.

If you know the story, I don’t need to tell it. Three words and a decade just handed you the whole thing: the clause in the contract, the reason it wasn’t pettiness, the test hiding inside the sweets. You rebuilt all of it from almost nothing, because you and I happen to share the reference. That leap, from a fragment to the full picture, is the entire subject of this piece.

Compliance as an Inherited Property

Thu, 16 Jul 2026 00:00:00 +0000

The scanner stopped us because of an uninstall command.

We had built a small documentation-lookup tool for internal AI use at a global security vendor: a way for a language model to answer questions from official product documentation instead of guessing, and to ensure that everyone had the same chance equivalent (but not necessarily identical) answers from the LLM guided sessions. The reference material included a vendor’s published, supported uninstall procedure, which, like ten thousand other uninstall procedures, contains rm -rf. The static security scanner in the review pipeline found the string, classified it as a critical finding, and the pull request stopped at InfoSec.

Right Finding, Wrong Fix

Thu, 15 May 2025 00:00:00 +0000

A client of ours turned off a server one afternoon and stopped their partner payments cold. Not a nation-state, not ransomware. A scanner had flagged the box for a weak TLS configuration, the finding was accurate, someone acted on it quickly and responsibly, and a legacy system quietly holding up a chunk of their partner-transaction processing went dark along with it. Nobody in the room had known what ran through it. The security work was correct. The result was an outage.

About

Mon, 01 Jan 0001 00:00:00 +0000

I’m Simon Mullis. Thirty years in cybersecurity, and my job title has never quite captured the work. Mostly I’ve worked in the field, as a sales engineer and solutions architect, but the whole time I’ve been doing the extra stuff too: writing the code, giving the talks, being the person sent in to explain the hard thing.

I’ve been coding for over twenty five years, from shell and object-oriented Perl (I’m not sorry) through Ruby and Python to a lot of Go and, lately, Rust. I’ve built and shipped enterprise SaaS, always with a team carrying half the weight. For five years I was CTO of Venari Security, a post-quantum cryptography startup, which is where I learned how much of security is an inventory problem wearing a maths costume.

Colophon

Mon, 01 Jan 0001 00:00:00 +0000

Every essay here ends with a short dated note: what was happening in the world, in technology, and in AI when it was written, and where I was standing at the time.

That’s deliberate. Writing about AI dates badly, because you usually can’t tell what the author knew at the time. A claim that looked bold in early 2026 can read as either obvious or naive two years later, and without the dateline you can’t tell which. Pinning each piece to its moment lets you judge it fairly. It also lets me come back later and mark my own homework: did the pattern get stronger or weaker as the models improved? That test, run honestly, is worth more than the original argument was.

Contact

Mon, 01 Jan 0001 00:00:00 +0000

The best way to reach me is email: simon@mullis.co.uk.

I’m also on LinkedIn and GitHub.