Cybersecurity and AI governance — from a consulting team that ships compliance and resilience programmes for real, not for slides.
A practitioner's guide to NIS2 implementation that goes beyond control catalogs. It covers what regulators actually look for, where mid-market security teams stall, and how to build a defensible programme in 90 days.
A practical translation between what boards ask about cloud risk and what engineering teams actually have to build. No fluff, no maturity-model bingo, just the controls that move the loss curve.
What zero-trust actually means at the implementation layer when you don't have a Google-scale budget. The four moves that close 80 percent of the realistic attack surface, and the trap that swallows the rest.
How to run a SIEM and SOAR programme that produces actionable detections rather than a 200-deep Slack channel of high-severity noise. The detection-engineering practices that separate functional SOCs from theatrical ones.
The IBM Cost of a Data Breach number is famous. The decisions a CISO can make today to bend that number down are less famous. The four investment categories that demonstrably reduce loss expectancy and the popular ones that mostly do not.
ISO 42001 is the first AI management system standard with audit teeth. This is how to actually implement it, where the typical programmes get stuck, and what the EU AI Act overlap saves you.
The OWASP LLM Top 10 isn't a checklist. It's a threat model that maps cleanly onto product security work if you know how to read it. Where the real risks live in production GenAI deployments and what to actually build.
The framing of prompt injection as a model-quality problem misdirects attention. The realised attacks land in production because of architecture decisions, not because the model is gullible. The product-security pattern that closes the class.
What an AI risk assessment looks like when it has to satisfy a financial-services regulator, a healthcare auditor, or an industrial safety body. The structure that holds up under scrutiny and the sections that turn into evidence.
The three patterns most GenAI applications now combine, with the trade-offs that matter at scale. Latency, cost, evaluation difficulty, governance burden — the parts of the decision that don't show up in the demo.