Unmitigated Risk

I’m Ryan Hurst. For more than three decades I have worked on the systems that help people and organizations know what to trust online, from cryptography and identity to the infrastructure that connects them. In that time I have led engineering, product, operations, and compliance organizations.

Full biography

Latest essay, September 15, 2026, 8 min read

Rejection Is Not a Verdict

Life & Family

Life offers an almost unlimited supply of chances to be rejected, and it is easy to take each one personally. Picture a young man who works up the nerve to cross a room, tell a woman he finds her beautiful, and ask for her number. She says no, and he walks away believing she looked him over, weighed what she saw, and found it lacking. That may not be what happened at all. She may have slept badly, or been running late, or just ended a relationship, or be seeing someone already. He may have reminded her of someone…

Read the full essay

More recent essays

The Amnesia Cycle and Why AI Is Turning Developers Back Into TestersAugust 19, 202612 min readAI Engineering & Code
I started working in technology around 1993. One of my first jobs was in quality assurance, partly because there was no security profession to join yet.
Hurst UniversityAugust 17, 202618 min readLife & Family AI
For as long as my children can remember, I have told them that they are students at Hurst University.
From Periodic Audit to Continuous AssuranceAugust 6, 20261 min readCompliance & Audits AI
I have been writing about the limitations of audits and compliance systems for several years.
From Chains to TreesAugust 4, 20261 min readPKI & Certificates
The WebPKI has two structures that are not the same shape.
The Status Quo Outlived Its StatusJuly 17, 20266 min readSecurity Practice
In security we like to say that the problems live in the gaps between systems. Each system, on its own, is usually coherent. It has a threat model, invariants, and someone who owns it. The seam between two systems is…
Why FIPS 140 Means Running Old CodeJuly 13, 20263 min readCompliance & Audits Cryptography & Keys
You need to use FIPS 140 because of compliance, but have you ever asked what that requirement is actually for? What security properties are the authors of these policies trying to achieve?
The Certification Ends Where the Code BeginsJuly 10, 20265 min readCompliance & Audits Cryptography & Keys
Disclosure: I am an advisor to Binarly.
Steve Jobs, AI, and the Problem of Analysis Without OwnershipJuly 9, 20265 min readAI Leadership & Product
There is an old Steve Jobs clip from a 1992 MIT Sloan talk that feels newly relevant in the age of AI. In the talk, available here as Steve Jobs MIT 1992 Lecture, Jobs is asked about consultants. His answer is not that…

All 378 posts, by year

Long-form

All 7 longer pieces, each going deeper than a post and published as its own page.

Security Design Never Scaled40 min readSecurity Practice AI
Two services, one bug, every instrument calling them identical. We scaled security’s answers but never the reasoning behind them, and machine reasoning may finally change that.
Containing the Optimizer60 min readSecurity Practice AI
A field guide to what containers, VMs, confidential VMs, and enclaves actually protect, and what it costs when each one fails.
The Assurance Model Was Built for a World That No Longer Exists40 min readCompliance & Audits AI
How periodic audit came to be, why its epistemic reach is shrinking, and what AI does to the mismatch.
Why Continuous Assurance Did Not Happen Until Now55 min readCompliance & Audits AI
The economics of cognition, the limits of GRC software, and what AI actually changes.
The Post-Quantum WebPKI50 min readPKI & Certificates Cryptography & Keys
How the Internet will decide which public keys to trust once signatures no longer fit on the wire.
A Deep Dive on the Classical WebPKI90 min readPKI & Certificates
How the Internet decides which public keys to trust.
FIPS 140-3 Validation, in Practice10 min readCompliance & Audits Cryptography & Keys
What the US and Canadian standard for validating cryptographic modules actually covers, with data from the validation corpus.

Recent talks and interviews

Oct 2025
Understanding digital identity: lessons from history and techState-Endorsed Digital Identity (SEDI) Summit, Utah Valley University
Sep 2025
Tech innovation and unsolved problems in securityInterview, Security Conversations podcast
Sep 2024
Conquering the post-quantum threats of tomorrow, todayInfoSec World 2024
Sep 2024
How to make the most out of cryptographic inventories for your organizationPanel lead, International Cryptographic Module Conference (ICMC 2024), San Jose
Sep 2024
HSMs and post-quantum: can they keep up?Panelist, International Cryptographic Module Conference (ICMC 2024), San Jose
Jul 2024
Authentication levels for workloadsIETF 120, WIMSE working group
2018
Certificate TransparencyVideo, PrimeKey Tech Days 2018

I have been speaking at conferences since the 1990s, including RSA Conference.

Standards

2026
draft-ietf-acme-device-attestACME Device Attestation ExtensionCo-author. IETF ACME working group draft that lets a CA validate a device’s identity through hardware attestation.
2010
RFC 5793PB-TNC: A Posture Broker Protocol Compatible with Trusted Network ConnectCo-author, with Intel and Juniper. The posture broker protocol for network endpoint assessment, identical to the Trusted Computing Group’s IF-TNCCS 2.0.
2008
RFC 5216The EAP-TLS Authentication ProtocolCo-author. Certificate-based authentication for Wi-Fi and wired 802.1X networks.
2007
RFC 5019The Lightweight OCSP Profile for High-Volume EnvironmentsCo-author, with VeriSign. Makes OCSP practical at high volume through smaller messages and cacheable responses. Obsoleted in July 2026 by RFC 9919, which moves the profile to SHA-256.
PIVPersonal Identity Verification (NIST FIPS 201 and related specifications)Contributor. The U.S. federal standard for the smart card identity credentials issued to government employees and contractors.
ISO 32000Portable Document Format (PDF)Contributor to the ISO standard that defines PDF documents.
GIDSGeneric Identity Device SpecificationContributor. The smart card specification Windows has supported with a built-in driver since Windows 7 SP1.

These are highlights from a longer record of work across the IETF, the Trusted Computing Group, ISO, and NIST.