Blog
Field notes on security and AI, written by a practitioner.
Long-form writing for risk, security, and board readers. Framework-anchored, regulator-literate, and informed by what actually happens in mid-market deployments.
6 min read
Cloud security baseline: the controls that actually matter
AWS, Azure, and GCP each have a hundred security knobs. Most mid-market organisations have configured fifteen of them, badly. The realistic baseline is closer to thirty controls: high-leverage, configurable in days, not months.
- Cloud security
- AWS
- Azure
3 min read
Evals are a risk control. Most AI deployments are missing them.
If you cannot quantify the failure rate of a deployed AI system, you cannot say what its residual risk is, and the regulators are starting to ask. Evals are the discipline that closes the gap, and they are simpler to start than the literature implies.
- AI evals
- AI
- Risk
7 min read
The APRA CPS 234 audit: what auditors actually look for
Most CPS 234 audit findings are not surprises to the audited entity. They are gaps the entity already knew about and chose to defer. The audit just makes them visible. Here's the structure of the audit and the findings that recur.
- CPS 234
- Audit
- Information security
Stay informed
Get new posts by email.
One email a fortnight. Long-form content only, no promotional sequences. Unsubscribe at any time.
Get started
Talk to the security lead who would do the work.
A thirty-minute discovery call costs nothing. We confirm fit, scope, and timing, then issue a fixed-fee statement of work within two business days.