Practical explainers on securing and governing AI, written by practitioners. No vendor content, just how these systems fail and what to do about it.
Model weights are arriving from registries most security teams have never reviewed, in formats that execute code at load time. What model supply chain security has to cover and how to harden the path between download and deployment.
The AIBOM is showing up in procurement questionnaires and regulator guidance, and most existing inventories miss the parts that matter. What an AIBOM should record and how to keep one current.
Least privilege was built for users and static service accounts. Agents compose their own workflows at runtime, and the old scoping model leaves gaps that only show up at incident time.
Standard cyber policies were not written for AI exposure. Where the coverage mismatch sits, which exclusions to read before the next renewal, and how to close the gap before a claim tests it.
RAG feels like a safety mechanism, so most teams never review the retrieval layer. It is the channel that moves untrusted content straight into a model's context. What to harden and how to test it.
AI features are landing in vendors your organization already bought. What due diligence should cover for embedded AI, model providers, and downstream data exposure.
MCP servers have quietly become one of the most exposed components in enterprise AI environments. What the real risks look like and how to build a defensible deployment.
The EU AI Act applies to non-EU organizations more often than most teams realize. What triggers it, what it requires, and how to prepare.
Most production AI systems log essentially nothing useful for incident detection. What needs to be captured and how to detect agent compromise.
Most AI risk registers are spreadsheets that won't survive a serious audit. What auditors actually want to see, and how to build a register that holds up.
Pentesting an AI system is not pentesting a web app with a model behind it. What AI red-teaming actually looks like and where traditional methodologies break down.
Most regulated companies don't have an AI governance gap, they have a void. Here's what closing it actually requires.
AI is compressing the window between vulnerability disclosure and active exploitation. Monthly patch cycles weren't built for this.
The AI tools your organization didn't approve are already in use. The question is how large it is and what it's touching.
The first international standard for AI management systems. Customer questionnaires are already asking about it.
The best available taxonomy for AI system risks, but most teams are reading it wrong. A practitioner's view for regulated environments.
Your engineers are already using Cursor, Claude Code, and Copilot. Here's what a real governance program looks like.
The most widely exploited vulnerability in deployed AI systems, and most organizations don't have detection built for it.
The FDA and EMA are watching AI in regulated manufacturing and clinical operations. What organizations need to be documenting now.
Most governance fails not because the policy is wrong, but because the process is so slow developers route around it.
We're happy to have a direct conversation, no pitch, no process.
