Writing on AI governance, cybersecurity GRC, regulation and assurance.https://khnaveed.com/enhttps://khnaveed.com/articles/a-gate-you-can-bypass-is-not-a-gate/https://khnaveed.com/articles/a-gate-you-can-bypass-is-not-a-gate/Twelve scanners in the pipeline and the auditor still says no. Four structural failures that make a DevSecOps programme unprovable, and what replaces each one.Fri, 04 Sep 2026 00:00:00 GMTDevSecOpsAssuranceApplication Securityhttps://khnaveed.com/articles/eu-ai-act-clocks-already-running/https://khnaveed.com/articles/eu-ai-act-clocks-already-running/The Act is discussed as though it arrives in the future. Four of its obligations took effect before most organisations finished reading it.Mon, 24 Aug 2026 00:00:00 GMTEU AI ActRegulationAI Governancehttps://khnaveed.com/articles/ai-inventory-that-survives-an-audit/https://khnaveed.com/articles/ai-inventory-that-survives-an-audit/Most AI inventories are lists of names. An auditor will ask questions a list of names cannot answer. Here is the minimum a record has to carry.Mon, 10 Aug 2026 00:00:00 GMTAI TRiSMAssuranceAI Governancehttps://khnaveed.com/articles/the-economic-singularity/https://khnaveed.com/articles/the-economic-singularity/An eight-level professional ladder, the ADAPT framework, and a role-by-role look at automation exposure. A career survival manual rather than a technology article.Sun, 29 Mar 2026 00:00:00 GMTAI GovernanceFuture of Workhttps://khnaveed.com/articles/wargaming-a-systemic-cyber-collapse/https://khnaveed.com/articles/wargaming-a-systemic-cyber-collapse/In 2007 Hollywood called it a fire sale. Today threat analysts call it systemic cyber risk — and the Mosaic Doctrine is how adversaries get past your perimeter.Tue, 17 Mar 2026 00:00:00 GMTThreat IntelligenceResiliencehttps://khnaveed.com/articles/from-bolt-on-to-built-in-secure-sdlc/https://khnaveed.com/articles/from-bolt-on-to-built-in-secure-sdlc/Security discovered two weeks before launch is an architecture problem, not a testing problem. Five phases of a Secure SDLC, told through the failures each one prevents.Fri, 19 Dec 2025 00:00:00 GMTDevSecOpsAssurancehttps://khnaveed.com/articles/think-before-you-share-saudi-data-sharing/https://khnaveed.com/articles/think-before-you-share-saudi-data-sharing/Every outbound dataset is a handshake. A practical guide to PDPL, SDAIA, NDMO, SAMA and NCA obligations for private sector organisations in the Kingdom.Fri, 27 Jun 2025 00:00:00 GMTSaudi RegulationData ProtectionThird-Party Riskhttps://khnaveed.com/articles/the-ultimate-guide-to-data-loss-prevention/https://khnaveed.com/articles/the-ultimate-guide-to-data-loss-prevention/Seven pillars of a DLP programme, from discovering the data you have forgotten about to building the human firewall that stops the rest.Sun, 09 Mar 2025 00:00:00 GMTData ProtectionAssurancehttps://khnaveed.com/articles/cybersecurity-in-change-management/https://khnaveed.com/articles/cybersecurity-in-change-management/Most breaches trace back to a change nobody assessed. A step-by-step look at where security belongs in the change process, and what happens when it is missing.Sat, 01 Feb 2025 00:00:00 GMTAssuranceDevSecOpshttps://khnaveed.com/articles/third-party-risk-management/https://khnaveed.com/articles/third-party-risk-management/Your cybersecurity is only as strong as your weakest vendor. Five components of a TPRM framework that actually finds the risk before it finds you.Sat, 18 Jan 2025 00:00:00 GMTThird-Party RiskAssurancehttps://khnaveed.com/articles/iam-framework-safeguard-your-digital-kingdom/https://khnaveed.com/articles/iam-framework-safeguard-your-digital-kingdom/Identity has become the control plane. The five building blocks of an IAM framework that enables the business rather than obstructing it.Sat, 11 Jan 2025 00:00:00 GMTIdentity & AccessAssurancehttps://khnaveed.com/articles/building-a-cloud-security-strategy/https://khnaveed.com/articles/building-a-cloud-security-strategy/Individual controls are tools in a backpack. A strategy is the map that turns them into a safety net — six things it has to settle.Fri, 10 Jan 2025 00:00:00 GMTCloud SecurityResiliencehttps://khnaveed.com/articles/kubernetes-security-a-universal-challenge/https://khnaveed.com/articles/kubernetes-security-a-universal-challenge/Hundreds of clusters, including Fortune 500 estates, found openly accessible. The misconfigurations do not care whether you run in cloud or on-premises — and neither should your response.Thu, 10 Aug 2023 00:00:00 GMTCloud SecurityAssurance