Longer-form analysis and opinion on security, risk, AI and product.
Perspective/Security//7 min read
Attackers can steal authenticated sessions without defeating MFA itself. Enterprises need phishing-resistant authentication, token protection and session-aware incident response.
Perspective/Emerging Technology//7 min read
Digital identity is becoming a shared trust layer across organizations. Portable credentials can reduce repeated verification, but governance determines what those credentials mean.
Perspective/Product//6 min read
When AI can act on a user's behalf, permissions, approvals and recovery become part of the product. Teams must design delegated authority, not just interfaces.
Perspective/Emerging Technology//6 min read
Moving AI closer to devices can cut latency and data transfers, but it also distributes security and governance responsibilities. The future combines edge and cloud computing.
Perspective/AI//10 min read
Enterprise AI creates new paths to data and business systems. Its security risks depend on existing permissions, third-party data handling and the authority granted to agents.
Perspective/AI//10 min read
Agentic AI shifts systems from generating information to executing workflows. Its practical value depends on bounded authority, redesigned processes and risk-based human oversight.
Perspective/Product//10 min read
Cybersecurity risk is shaped by product decisions about data, access and integrations. Product managers need to build security into design and prioritisation, not defer it to launch.
Perspective/Security//8 min read
AI agents act across systems, but conventional IAM controls cannot fully govern their autonomy. Treating them as identities requires scoped access, ownership and traceability.
Perspective/Risk & Governance//7 min read
SOC 2 provides assurance over defined controls, not proof of security. Meaningful vendor risk reviews must examine report scope, timing and the risks of the service being purchased.
Perspective/Security//10 min read
Scanners identify weaknesses, but business context determines what to fix first. Effective vulnerability management weighs exposure, exploitability and asset criticality.
