Blog
Field notes on security and AI, written by a practitioner.
Long-form writing for risk, security, and board readers. Framework-anchored, regulator-literate, and informed by what actually happens in mid-market deployments.
6 min read
Ransomware response, CPS 230, and the 24-hour decision
The technical incident response is the easier half. The harder half is the decision your executive will be asked to make at the 6-hour mark and again at the 24-hour mark, and whether your organisation has actually decided how to make it.
- Ransomware
- Incident response
- CPS 230
5 min read
AI-assisted phishing: what's actually new
The volume of AI-assisted phishing has gone up; the success rate per attempt has not changed as much as the headlines suggest. The substantive change is the resource asymmetry, and what that means for your defensive program.
- AI
- Phishing
- Email security
6 min read
Just-in-time privileged access for mid-market
Standing administrative privilege is the largest avoidable risk in most mid-market environments. The fix is a procedural change supported by tooling you probably already own. The work is mostly the policy, not the technology.
- PAM
- Just-in-time
- Privilege
3 min read
Secrets sprawl is the boring breach pattern that keeps working
The interesting attack chains get the conference talks. The pattern that actually wrecks regulated firms is unrotated credentials in code, in CI variables, in vendor portals, and in places nobody owns. The cleanup is unglamorous, and the savings are large.
- Secrets management
- Credentials
- Platform engineering
6 min read
Third-party risk after the supply-chain attack era
Most third-party risk programs in mid-market financial services are questionnaire factories. They produce paperwork; they do not produce risk reduction. After several years of supply-chain incidents, the realistic position has changed. Here's what actually works.
- Supply chain
- Third-party risk
- Vendor management
6 min read
Cloud security baseline: the controls that actually matter
AWS, Azure, and GCP each have a hundred security knobs. Most mid-market organisations have configured fifteen of them, badly. The realistic baseline is closer to thirty controls: high-leverage, configurable in days, not months.
- Cloud security
- AWS
- Azure
Stay informed
Get new posts by email.
One email a fortnight. Long-form content only, no promotional sequences. Unsubscribe at any time.
Get started
Talk to the security lead who would do the work.
A thirty-minute discovery call costs nothing. We confirm fit, scope, and timing, then issue a fixed-fee statement of work within two business days.