Shorts
Short, self-contained pieces: one subject, one argument, a few minutes to read, sources at the end. When you need the full evidence, go to the research.
Dealing with one of these problems yourself? I work with organizations that need answers, not another slide deck. Let's talk.
What's in a five-angle short
Most subjects here are one page with five short sections, always in this order. Each has its own colour inside the article so you can jump to the one you need.
- 1Where I'd start: the first move I'd make, and the question I'd ask before spending anything.
- 2Where plans fail: where plans on this subject usually break, and the assumption I'd test first.
- 3Beyond the jargon: what the subject actually means once the vendor language is stripped out.
- 4What good looks like: the result that would tell you it worked, and the number I'd watch.
- 5The call leaders can't dodge: the decision leadership has to own, and what it needs on the table to make it.
- Incident response 25
- Security operations 15
- Adversary emulation 11
- Threat intelligence and OSINT 11
- Forensics and investigation 11
- AI security 18
- Critical infrastructure 12
- Cloud security 11
- Network security 11
- Identity and zero trust 13
- Application security 10
- Software engineering 12
- Privacy and cryptography 11
- Fraud and phishing 11
- National security and cyber conflict 11
- Governance and risk 15
- Executive leadership 23
- Cyber economics 11
- Operational resilience 12
- Education and training 15
-
AI Governance: Who Can Actually Stop the System?
A policy saying humans remain in control is easy to write. I want to know what happens when an AI system is producing results everyone likes, the deadline is...
-
AI agent permissions
I would not begin AI agent permissions by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...
-
AI governance
I would not begin AI governance by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario...
-
AI phishing
I would not begin AI phishing by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario w...
-
AI risk communication
I would not begin AI risk communication by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
An AI Agent With Permission to Act Is a Security Architecture Problem
An AI assistant that answers a question is one kind of risk. An AI agent that can read a customer database, send messages, change permissions, and execute wo...
-
Before You Give an AI Agent Permission to Act
An AI system that answers a question can mislead you. An AI system that can open a ticket, change a configuration, retrieve private records, or send a messag...
-
Can You Control AI Without Understanding Every Answer?
Learn how AI control can focus on authority, evidence and consequences without requiring complete understanding of every internal computation.
-
LLM data leakage
I would not begin LLM data leakage by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Model evaluation
I would not begin model evaluation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Model monitoring
I would not begin model monitoring by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Model supply chain
I would not begin model supply chain by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Prompt injection
I would not begin prompt injection by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
RAG security
I would not begin RAG security by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario ...
-
What to ask an AI vendor before your data goes in
Procurement questionnaires for AI products tend to copy the ones for SaaS, and they miss the questions that matter.
-
When Does an AI Warning Become a Working Control?
Turn AI risk warnings into owned, funded and testable controls. A short from Boxing Einstein on the gap between recognizing a problem and changing it.
-
Why Useful AI Can Be Harder to Govern
Why a useful AI answer still needs evidence before wider use: distinguish observed benefits, hidden consequences and the cost of waiting.
-
Your staff are already using AI. Now what?
Banning it doesn't work. I've yet to see an organisation where a policy stopped people pasting a contract into a chatbot to summarise it. What the ban does i...
-
Adversary emulation isn't a pen test. Here's the difference
Both involve attacking your own environment. They answer different questions, and buying one when you need the other is a common waste.
-
Attack-path validation
I would not begin attack-path validation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one...
-
Cloud attack emulation
I would not begin cloud attack emulation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one...
-
Control validation
I would not begin control validation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Credential abuse simulation
I would not begin credential abuse simulation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, an...
-
Cyber range scenarios
I would not begin cyber range scenarios by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Lateral movement detection
I would not begin lateral movement detection by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and...
-
MITRE ATT&CK mapping
I would not begin MITRE ATT&CK mapping by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one s...
-
Phishing exercises
I would not begin phishing exercises by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Purple team workshops
I would not begin purple team workshops by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Red team scoping
I would not begin red team scoping by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
API authorization
I would not begin API authorization by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
Authentication design
I would not begin authentication design by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Code review
I would not begin code review by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario w...
-
Dependency vulnerabilities
I would not begin dependency vulnerabilities by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and...
-
Release engineering
I would not begin release engineering by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
Secrets in repositories
I would not begin secrets in repositories by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...
-
Secure SDLC
I would not begin secure SDLC by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario w...
-
Security testing
I would not begin security testing by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scena...
-
Software supply chain
I would not begin software supply chain by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Threat modeling
I would not begin threat modeling by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenar...
-
Cloud IAM
I would not begin cloud IAM by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario wor...
-
Cloud network segmentation
I would not begin cloud network segmentation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and...
-
Cloud recovery
I would not begin cloud recovery by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
-
Cloud security economics
I would not begin cloud security economics by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and o...
-
Container security
I would not begin container security by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Control-plane logging
I would not begin control-plane logging by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one ...
-
Infrastructure as code
I would not begin infrastructure as code by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one...
-
Kubernetes RBAC
I would not begin Kubernetes RBAC by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenar...
-
Multi-cloud governance
I would not begin multi-cloud governance by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one...
-
Secrets management
I would not begin secrets management by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Your cloud bill is a security signal
The finance team sees it first and doesn't know what it means. A compute line that doubled over a weekend. A region you've never used. Egress to somewhere un...
Nothing matches. Try another word, or ask me directly.