Blog
Field notes on security and AI, written by a practitioner.
Long-form writing for risk, security, and board readers. Framework-anchored, regulator-literate, and informed by what actually happens in mid-market deployments.
25 min read
Grok 4.7 vs GPT-6 Astra vs Claude: a CISO's security comparison
Grok 4.7, GPT-6 Astra and Claude Opus 5.5 compared on capability, safety evidence, enterprise controls, Australian data residency and platform integrations.
- AI governance
- LLM security
- AI agents
10 min read
The state of AGI: what the evidence supports, and what it does not
A sober read of the AGI evidence in 2026: what frontier systems can measurably do, what expert forecasts actually say, how seriously to take the existential question, and what the research shows about humans and AI working together.
- AGI
- AI research
- Risk
9 min read
The AI register: the audit artefact every framework now assumes you have
Auditors, regulators, and insurers now open with the same request: show me the list of your AI systems. What an AI register is, what ISO 42001, NIST AI RMF, the EU AI Act, and Australian government policy expect it to contain, and how to keep one alive.
- AI register
- AI governance
- ISO 42001
10 min read
Fractional CISO services in Australia: cost, scope, and when the model works
What a fractional CISO actually does, what the role costs in Australia, the failure modes nobody advertises, and where the always-on digital CISO fits next. A straight guide for mid-market boards weighing their security leadership options.
- Fractional CISO
- Security leadership
- Board reporting
29 min read
The agentic SOC is real, and your logs are now prompts: how AI security monitoring actually works, and where it breaks
Microsoft, Google and CrowdStrike now ship autonomous agents that triage alerts in real time with no analyst in the loop. What agentic SOC tooling actually does, the research showing attackers can prompt-inject it through ordinary log fields, and the control set that holds under APRA scrutiny.
- AI agents
- Detection engineering
- SOC
19 min read
AI supply chain security: four ways code now enters your estate without a vendor review
Model weights, agent skills, MCP servers and packages your coding assistant invented all execute in your environment, and none of them trigger a vendor assessment. The documented incidents, the measured scale, and the controls that close the gap before CPS 230 makes it an audit finding.
- Supply chain
- Third-party risk
- AI agents
Stay informed
Get new posts by email.
One email a fortnight. Long-form content only, no promotional sequences. Unsubscribe at any time.
Get started
Talk to the security lead who would do the work.
A thirty-minute discovery call costs nothing. We confirm fit, scope, and timing, then issue a fixed-fee statement of work within two business days.