Writing

Articles

Notes from the work — AI governance, regulation, assurance and the evidence that has to exist underneath. Written for people who have to implement, not admire.

4 September 2026 9 min

A Gate You Can Bypass Is Not a Gate

Twelve scanners in the pipeline and the auditor still says no. Four structural failures that make a DevSecOps programme unprovable, and what replaces each one.

DevSecOpsAssuranceApplication Security

Read

24 August 2026 6 min

Four of the EU AI Act's obligation clocks are already running

The Act is discussed as though it arrives in the future. Four of its obligations took effect before most organisations finished reading it.

EU AI ActRegulationAI Governance

Read

10 August 2026 5 min

An AI inventory that survives an audit

Most AI inventories are lists of names. An auditor will ask questions a list of names cannot answer. Here is the minimum a record has to carry.

AI TRiSMAssuranceAI Governance

Read

29 March 2026 3 min

The economic singularity: you won't be replaced by AI, but by someone using it

An eight-level professional ladder, the ADAPT framework, and a role-by-role look at automation exposure. A career survival manual rather than a technology article.

AI GovernanceFuture of Work

Read

17 March 2026 3 min

From Die Hard to real war: wargaming a systemic cyber collapse

In 2007 Hollywood called it a fire sale. Today threat analysts call it systemic cyber risk — and the Mosaic Doctrine is how adversaries get past your perimeter.

Threat IntelligenceResilience

Read

19 December 2025 7 min

From 'Bolt-On' to 'Built-In': how to architect security before writing a single line of code

Security discovered two weeks before launch is an architecture problem, not a testing problem. Five phases of a Secure SDLC, told through the failures each one prevents.

DevSecOpsAssurance

Read

27 June 2025 11 min

Think before you share: a strategic guide to private sector data sharing in Saudi Arabia

Every outbound dataset is a handshake. A practical guide to PDPL, SDAIA, NDMO, SAMA and NCA obligations for private sector organisations in the Kingdom.

Saudi RegulationData ProtectionThird-Party Risk

Read

9 March 2025 8 min

The ultimate guide to data loss prevention

Seven pillars of a DLP programme, from discovering the data you have forgotten about to building the human firewall that stops the rest.

Data ProtectionAssurance

Read

1 February 2025 7 min

Cybersecurity in change management: why every click and byte matters

Most breaches trace back to a change nobody assessed. A step-by-step look at where security belongs in the change process, and what happens when it is missing.

AssuranceDevSecOps

Read

18 January 2025 7 min

Third-party risk management: shielding your business from hidden threats

Your cybersecurity is only as strong as your weakest vendor. Five components of a TPRM framework that actually finds the risk before it finds you.

Third-Party RiskAssurance

Read

11 January 2025 7 min

IAM: the secret formula to safeguard your digital kingdom

Identity has become the control plane. The five building blocks of an IAM framework that enables the business rather than obstructing it.

Identity & AccessAssurance

Read

10 January 2025 6 min

Building a cloud security strategy that inspires confidence

Individual controls are tools in a backpack. A strategy is the map that turns them into a safety net — six things it has to settle.

Cloud SecurityResilience

Read

10 August 2023 6 min

Kubernetes security: a universal challenge

Hundreds of clusters, including Fortune 500 estates, found openly accessible. The misconfigurations do not care whether you run in cloud or on-premises — and neither should your response.

Cloud SecurityAssurance

Read

Subscribe by RSS.