Thinking out loud
Short essays on Zero Trust, identity, AI governance and security leadership. Most started as LinkedIn posts; the discussion often continues there. RSS feed
Your AI budget is a security control
Spend caps on AI services do more than protect the invoice. They are the cheapest early-warning system you can switch on.
Read →After a merger, the first security project is a list
Two companies become one on paper long before they become one in the asset register. Until the inventories match, nothing else you secure is complete.
Read →A review gate is a service, not a checkpoint
If the architecture review takes longer than the workaround, people take the workaround. Design the gate around the person waiting at it.
Read →Who reviewed this access request?
Over-provisioned access rarely comes from bad actors. It comes from convenience moving faster than scrutiny, one handoff at a time.
Read →Where does your data go after you hit Enter?
Most organisations evaluate AI on what the model can do. Very few evaluate what happens to the data after the prompt is submitted.
Read →64 million records behind "123456"
We spend millions on Zero Trust and AI threat detection, and somewhere in the same enterprise a vendor test account still has default credentials.
Read →The department of "no" has already lost
When security becomes the department of "no", people stop asking and start routing around it. That is the real failure mode.
Read →We named Zero Trust wrong
Zero Trust was never about trusting nothing. It was about making trust earn itself, every time.
Read →The perimeter now lives in your OAuth consent screens
The Vercel disclosure is not a Vercel story. It is the cleanest public example yet of shadow AI walking in through an OAuth grant.
Read →Security is optional, until it isn't
The startups that get security right do not have bigger budgets. They made one decision earlier: a named, accountable person from day one.
Read →Everyone reviews the identities they can see
Human identities get audits, owners and expiry cycles. Machine identities get created, given broad permissions and forgotten.
Read →Silence in a network is not safety
We built reporting cultures around counting what we find, and almost nothing around measuring what we cannot see.
Read →The gap between AI policy and AI agents
Most organisations have an AI governance policy. Very few know how many AI agents are actually running in their environment.
Read →Zero Trust ends where your machine-identity inventory ends
Machine identities outnumber humans by as much as 6 to 1, and almost none have a named owner. That is a governance gap, not a technology gap.
Read →Identity is a business continuity problem
Identity weaknesses show up in nearly 90% of breach investigations, and we are still in meetings debating firewall rules.
Read →IPO security starts at seed
Companies that struggle at IPO are not insecure. They are unprepared to prove they are secure.
Read →Five security questions that come up in due diligence
None of these need a big budget. All of them need intention, and they are easier to answer if you started early.
Read →