Skip to content

Blog

Field notes on security and AI, written by a practitioner.

Long-form writing for risk, security, and board readers. Framework-anchored, regulator-literate, and informed by what actually happens in mid-market deployments.

9 min read

The AI register: the audit artefact every framework now assumes you have

Auditors, regulators, and insurers now open with the same request: show me the list of your AI systems. What an AI register is, what ISO 42001, NIST AI RMF, the EU AI Act, and Australian government policy expect it to contain, and how to keep one alive.

  • AI register
  • AI governance
  • ISO 42001

10 min read

Fractional CISO services in Australia: cost, scope, and when the model works

What a fractional CISO actually does, what the role costs in Australia, the failure modes nobody advertises, and where the always-on digital CISO fits next. A straight guide for mid-market boards weighing their security leadership options.

  • Fractional CISO
  • Security leadership
  • Board reporting

29 min read

The agentic SOC is real, and your logs are now prompts: how AI security monitoring actually works, and where it breaks

Microsoft, Google and CrowdStrike now ship autonomous agents that triage alerts in real time with no analyst in the loop. What agentic SOC tooling actually does, the research showing attackers can prompt-inject it through ordinary log fields, and the control set that holds under APRA scrutiny.

  • AI agents
  • Detection engineering
  • SOC

19 min read

AI supply chain security: four ways code now enters your estate without a vendor review

Model weights, agent skills, MCP servers and packages your coding assistant invented all execute in your environment, and none of them trigger a vendor assessment. The documented incidents, the measured scale, and the controls that close the gap before CPS 230 makes it an audit finding.

  • Supply chain
  • Third-party risk
  • AI agents

15 min read

Jailbroken AI as an attack tool: how attackers actually use it, and how to defend

Attackers jailbreak frontier models, rent dark LLMs like WormGPT, and bolt AI onto phishing, deepfake fraud, and agentic intrusions. The documented tradecraft, the real incidents, and the defence-in-depth controls that hold, with Rust guardrail code.

  • AI agents
  • Jailbreaking
  • Prompt injection

12 min read

Managing cryptography in the post-quantum era: what businesses need to do now, and the attacks already hitting encryption

The post-quantum standards are finalised and ASD's Information Security Manual stops approving RSA and elliptic-curve cryptography after the end of 2030, ahead of most of the world. The operational playbook: the attacks on encryption happening now, the honest quantum timeline, and how to run the migration.

  • Post-quantum
  • Cryptography
  • Cryptographic agility

Stay informed

Get new posts by email.

One email a fortnight. Long-form content only, no promotional sequences. Unsubscribe at any time.

Get started

Talk to the security lead who would do the work.

A thirty-minute discovery call costs nothing. We confirm fit, scope, and timing, then issue a fixed-fee statement of work within two business days.

Book a discovery call Free maturity assessment