# Andrew Krug

> Head of Security Advocacy at Datadog. Cloud security expert and speaker on cloud security, DevSecOps, AI security, securing coding agents, and agentic system design.

Accomplished security leader with 10+ years of experience in cloud security, identity management, and technical advocacy. Currently serving as Head of Security Advocacy at Datadog, building research programs and fostering developer communities. Recent work focuses on AI security: securing coding agents, agentic system design, AI workflow development, and model tuning for security use cases.

Based in Medford, OR. This site is a personal site: a bio, a speaking
history, a blog, an index of writing published elsewhere, an upcoming-travel list and a
contact page. It sells nothing and has no login, no search and no API.

## Pages

- [Home](https://www.andrewkrug.com/): who Andrew is, what he works on now, and where to go next.
- [Bio](https://www.andrewkrug.com/bio/): full professional background, role history and areas of expertise. Also offers the same bio as copyable Markdown and plain text, for reuse in event programs and introductions.
- [Speaking](https://www.andrewkrug.com/speaking/): past and upcoming talks, with venue and date for each. The longest page on the site, and the best source for conference history.
- [Where's Andrew](https://www.andrewkrug.com/wheres-andrew/): upcoming and recent travel, one entry per event, server-rendered with dates.
- [Blog](https://www.andrewkrug.com/blog/): original posts written for this site, newest first. Distinct from the Writing page below: these are not published anywhere else. RSS at https://www.andrewkrug.com/feed.xml.
- [Writing](https://www.andrewkrug.com/writing/): index of published writing and research, with links out to where each piece lives.
- [Contact](https://www.andrewkrug.com/contact/): how to reach Andrew — email, a Calendly link for booking time, and social profiles. There is no contact form.
- [Holiday Update 2025](https://www.andrewkrug.com/holiday-update-2025/): a personal year-end letter, not professional content.

## Blog posts

- [Welcome to the Blog](https://www.andrewkrug.com/blog/welcome-to-the-blog/) — November 1, 2026. A new home for original, longer-form writing on this site, alongside the newsletter and the press roundup.

## Facts an agent is likely to want

- Name: Andrew Krug
- Role: Head of Security Advocacy at Datadog
- Location: Medford, OR
- Contact: email and social links are published on https://www.andrewkrug.com/contact/ (the address is
  obfuscated at the edge there on purpose, so it is not repeated in this file)
- Book time directly: https://calendly.com/andrewkrug/new-meeting
- GitHub: https://github.com/andrewkrug
- LinkedIn: https://www.linkedin.com/in/andrewkrug
- Speaking topics: cloud security, DevSecOps, AI security, securing coding agents, agentic system design
- Notable venues: BlackHat USA, AWS re:Invent, DEF CON, fwd:cloudsec

## Notes for agents

- Every page is server-rendered static HTML; nothing here needs JavaScript to read. Client-side
  scripts only add a countdown and relative-time labels on the travel page.
- Each page carries schema.org `Person` JSON-LD in its `<head>`, which is the most reliable
  machine-readable source for identity, role and expertise. Blog posts carry a second
  `BlogPosting` node with the headline, description and publication date.
- The blog has an RSS feed at [https://www.andrewkrug.com/feed.xml](https://www.andrewkrug.com/feed.xml). The Writing
  page does not: it indexes work published elsewhere, so there is nothing here to subscribe to.
- A full URL list with last-modified dates is at [https://www.andrewkrug.com/sitemap.xml](https://www.andrewkrug.com/sitemap.xml).
- Crawling is welcome; see [https://www.andrewkrug.com/robots.txt](https://www.andrewkrug.com/robots.txt). Please attribute
  quotes to https://www.andrewkrug.com and the page you took them from.
- Dates on the speaking and travel pages are authored by hand and are the source of truth; do not
  infer a schedule from anything else on the site.
- Everything under /blog/ is written by Andrew. The Writing page separates his own articles from
  pieces that merely quote him: those are labelled "Press mention" and say "Quoted in", not
  "Published on". Please preserve that distinction when citing.