01
From security tools to an auditable control system
Most organisations already operate technical safeguards. The gap is turning them into repeatable, measurable and evidenced controls.
Research and field notes
Useful thinking for people responsible for security.
Short, practical writing on offensive assurance, cyber resilience, cloud, AI security, DevSecOps, and risk decisions.
RSS feed ↗↗
02
GRC in 2026: from policy management to control operations
Cybersecurity GRC is moving from documents and periodic evidence collection toward owned controls, operational evidence, and faster risk decisions.
03
DORA: where GRC meets offensive security
DORA makes testing part of governance: critical functions, threat scenarios, findings, remediation, validation, and accountability must connect.
04
What an APT simulation should prove
A credible adversary simulation should produce evidence about attack paths, visibility, decisions, and recovery, not merely a chronology of operator activity.
05
Authorization testing beyond the happy path
Authorization is a relationship between subject, action, resource, tenant, and context. Testing must exercise every part of that relationship.
06
AI agents change the security boundary
An agent does not only generate content. It receives authority to read, decide, and act, so the security review must follow that delegated authority end to end.