Blog
Field notes on security and AI, written by a practitioner.
Long-form writing for risk, security, and board readers. Framework-anchored, regulator-literate, and informed by what actually happens in mid-market deployments.
3 min read
The EU AI Act has reach. Australian firms should map exposure now.
The Act's territorial scope is broader than most Australian general counsel offices have appreciated. Two questions decide whether your AI deployment is in scope, and the documentation burden if it is, is non-trivial.
- EU AI Act
- Regulation
- AI governance
5 min read
Detection engineering for organisations without a 24/7 SOC
Most mid-market organisations don't have a 24/7 SOC and won't justify the cost of one for years. That's not a reason to give up on detection. It's a reason to be specific about what you actually need to detect, and how.
- Detection engineering
- SIEM
- SOC
6 min read
Ransomware response, CPS 230, and the 24-hour decision
The technical incident response is the easier half. The harder half is the decision your executive will be asked to make at the 6-hour mark and again at the 24-hour mark, and whether your organisation has actually decided how to make it.
- Ransomware
- Incident response
- CPS 230
5 min read
AI-assisted phishing: what's actually new
The volume of AI-assisted phishing has gone up; the success rate per attempt has not changed as much as the headlines suggest. The substantive change is the resource asymmetry, and what that means for your defensive program.
- AI
- Phishing
- Email security
6 min read
Just-in-time privileged access for mid-market
Standing administrative privilege is the largest avoidable risk in most mid-market environments. The fix is a procedural change supported by tooling you probably already own. The work is mostly the policy, not the technology.
- PAM
- Just-in-time
- Privilege
3 min read
Secrets sprawl is the boring breach pattern that keeps working
The interesting attack chains get the conference talks. The pattern that actually wrecks regulated firms is unrotated credentials in code, in CI variables, in vendor portals, and in places nobody owns. The cleanup is unglamorous, and the savings are large.
- Secrets management
- Credentials
- Platform engineering
Stay informed
Get new posts by email.
One email a fortnight. Long-form content only, no promotional sequences. Unsubscribe at any time.
Get started
Talk to the security lead who would do the work.
A thirty-minute discovery call costs nothing. We confirm fit, scope, and timing, then issue a fixed-fee statement of work within two business days.