Independent reflections on cybersecurity, digital trust, governance, architecture, and leadership.
Not every personal-data use case can be anonymised. The discipline is to ensure data remains identifiable only where there is a valid reason—and to reduce exposure everywhere else.
AI coding agents are rapidly becoming part of developer workflows. The key security question is not how intelligent they are, but what they are allowed to access, execute, and change.
AirDrop and Quick Share highlight a difficult security trade-off: frictionless experiences often require systems to process information before trust is fully established.
A working Active Directory is not necessarily a resilient one. Explore six architectural principles that distinguish operational health from true cyber resilience.
Zero Trust is often misunderstood as “trust nobody” or simply another security product. Its true purpose is limiting the consequences when trust decisions prove wrong.
Major incidents often begin as ordinary work. Explore why familiarity, routine exceptions, and ignored near misses create the conditions for failure.
Is the absence of a cyberattack really evidence of strong security? Only one of the three possible explanations should inspire confidence.
A reflection on independence, incentives, vendor dependency, and the need for stronger internal cyber judgment.
Explore the difference between imagined, borrowed, and earned confidence, and why it matters to security leaders.
Why cybersecurity fails when certainty replaces curiosity, and why challenging assumptions is a vital security control.
More security telemetry does not always mean better security. Explore why the modern SOC must optimise for signal, not alert volume.
Behind every security control is a person. Explore why collaboration, culture, ownership, and human sustainability are essential to cyber resilience.
Not every breach claim is a real compromise. Explore how honeypots and deception technology can turn attacker activity into defensive intelligence.