Posts
All the articles I've posted.
Mapping cloud certifications to your own controls
AWS, Azure and Google Cloud hold near identical certificate lists and materially different scopes. A side by side comparison, a control by control mapping of what you still owe, and the three places the mapping usually goes wrong.
Security Critical Functions, and the things that control them
UK telecoms security regulation defines two categories of system, one nested inside the other. The distinction is better thinking than most security frameworks manage, and it applies well outside telecoms.
Measuring a control you cannot see failing
Most detection tools report what they found and say nothing about what they missed. Planting known records is how you get the number nobody will give you.
Macie and the hard problem of finding PII
Macie cannot reliably tell a payment card number from one of your own reference numbers. The privacy argument explains why that is hard to fix with your data, and not why it remains unfixed.
ISO 42001, ISO 27001 and the AI rulebook
What ISO 42001 actually is, how AI stresses an existing ISO 27001 management system, and where the rules stand across the EU, US, UK, Asia and the Gulf as of late 2026.
MLOps vs AIOps
The two names look like siblings and are close to opposites. What each inherits from DevOps, what MLOps has to handle that DevOps never did, and an honest answer on how transformational either one is.
Prompt injection through operational data
If you point a language model at your logs, tickets or alerts, an attacker who can write to any of those is writing part of your prompt. What that enables, and how to contain it.
The stages of AIOps
Two different things get called the stages of AIOps. One is a pipeline, one is a maturity ladder. What each says, where they came from, and how far to trust them.
What is AIOps
A plain English introduction to AIOps. What problem it solves, what the tools do, how far the label stretches, and why most of the value arrives before the AI does.