Andrew Horsburgh

I'm a builder, working in the open.

Lately that means building with AI, and keeping things as open and local as I can - open-source where it fits, running on hardware you control, and the process shared as I go.

About

I’ve been building things my whole life, across a stack of fields that doesn’t read as a straight line - drones from scratch back when you wired the flight controller yourself, 3D printers and CNC, a makerspace I ran for a few years, a few seasons flying bush and fire patrol. The range is the point. I’ve watched a lot of different systems fail, and I know what it costs when they do.

Writing code from scratch was the one wall I never got over. The architecture and the systems always made sense - I could read code and work out how it fit together - but turning that into working code from a blank file didn’t come. So I spent a couple of years going deep on cybersecurity and eventually climbed into the top 1% on TryHackMe’s global leaderboard, plus the systems and networking depth that came with it. Then AI arrived, the wall came down, and I went all in.

Now I build production systems mostly on my own, with a security mindset underneath and AI handling the syntax. Some of it is ambitious - there’s a robot with a safety layer on the bench right now. A lot of it is small and practical: custom tools and automations that strip the friction out of everyday tasks. Honestly, the small stuff is what I enjoy most.

How I keep up

The hard part of working in AI right now isn’t any one tool. It’s the pace. Whatever workflow I write down is stale in a couple of months, so I’ve stopped trying to perfect a process and started treating keeping up as the actual job. Read, build, throw it out, build again.

Having built across aviation, the trades, fabrication, and security helps more here than a single deep specialty would. New tools land every week, and most of them are old ideas in new packaging. When you’ve seen enough systems, you can tell what’s genuinely new, what actually matters, and what’s going to break - usually before the hype settles.

My read on security runs underneath all of it. The technical side is mostly mechanical and solvable, and AI already handles a lot of the detection. The part that stays vulnerable is the human layer. The big npm supply-chain attacks came down to a maintainer getting phished and giving away the keys - anyone can get caught on the wrong day, and AI is driving both the volume and the polish of those attempts up, so the soft target only gets softer. The release-age cooldowns the ecosystem now runs by default, this site included, showed up in direct reaction to those attacks: a patch for one vector that says nothing about the next. Most of security works like that, reactive by nature, which is why I’d rather build the discipline into a tool than bolt it on after something breaks.

Underneath the security framing, I’m a builder more than anything. The day-to-day of security operations doesn’t pull at me the way making something does. But the architecture instinct, the systems and networking knowledge, the feel for where things break - that’s the ground everything I build stands on.

Get in touch

If something here lands, or you’ve got a problem that fits the way I work, I’d like to hear about it. I’m open to new work right now - full-time, contract, or something that doesn’t fit a neat box yet.