Skip to content

Blog

Field notes on security and AI, written by a practitioner.

Long-form writing for risk, security, and board readers. Framework-anchored, regulator-literate, and informed by what actually happens in mid-market deployments.

3 min read

MCP and the new authorisation surface nobody is reviewing

Model Context Protocol turns every internal API into a tool an agent can call on a user's behalf. The authorisation model most teams ship with is naïve, and the audit log usually proves it.

  • MCP
  • Agents
  • Authorisation

5 min read

Digital employees, with the governance attached

Why most digital employee deployments fail their first audit, and what a governance-first build looks like: identity, data access, supervision, and the accountability question almost no-one is answering well.

  • Digital employees
  • Agents
  • Governance

4 min read

Mapping APRA CPS 230 to your AI tooling: a practical checklist

Translating CPS 230 material service obligations to Microsoft 365 Copilot, ChatGPT Enterprise, and Claude deployments: what changes when an AI vendor becomes a material service provider.

  • APRA
  • CPS 230
  • Vendor risk

3 min read

Securing CI/CD pipelines without slowing engineering down

Pipeline security is the gap between policy and reality. Most regulated firms have written rules about code review and signed releases that the actual pipeline does not enforce, and the audit evidence is whatever the runner happened to print to stdout.

  • CI/CD
  • Platform engineering
  • Supply chain

5 min read

Shadow AI in financial services: discovery without panic

A staged discovery method for surfacing personal AI account usage without destroying staff trust or productivity. What to look for, what to ignore, and what to do with what you find.

  • Shadow AI
  • Discovery
  • Privacy Act

3 min read

Policy-as-code as the control plane your auditors will actually read

Half the controls in a typical APRA submission are statements about what should happen. The other half could be expressed as policy code that runs in the pipeline and produces the evidence automatically. The gap between the two is most of the audit conversation.

  • Policy-as-code
  • OPA
  • Platform engineering

Stay informed

Get new posts by email.

One email a fortnight. Long-form content only, no promotional sequences. Unsubscribe at any time.

Get started

Talk to the security lead who would do the work.

A thirty-minute discovery call costs nothing. We confirm fit, scope, and timing, then issue a fixed-fee statement of work within two business days.

Book a discovery call Free maturity assessment