Insights
Working perspectives on the decisions that sit between technology, risk, governance and investment — written for the people who have to make them.
Cybersecurity · 24 September 2026 · 6 min read
An agent copilot is a place where untrusted customer text meets a language model, so it has to be treated like any other injection surface. Safety here comes from the architecture, not from clever prompt wording.
Read the articleCybersecurity · 8 September 2026 · 6 min read
Resilience improves when risk, architecture and delivery are decided together, rather than security arriving as a review at the end.
Read the articleCybersecurity · 28 August 2026 · 7 min read
In multi-tenant software, the most dangerous bug is one tenant seeing another's data. We made that entire class of bug fail closed by moving tenant isolation into the database with Row-Level Security, as a backstop to, not a replacement for, application-level scoping.
Read the articleCybersecurity · 15 August 2026 · 7 min read
Role-based access is easy to demo and hard to live with. The real question is not what a user can do, but which people and records they can do it to. Here is how we made access control safe by default and configurable by the school.
Read the articleCybersecurity · 7 July 2026 · 6 min read
A privacy claim you can test is worth more than one you assert. Here is how a versioned contract and a content-inspecting PII guard make the ingestion boundary itself the enforcement, and a real bug that discipline caught.
Read the articleCybersecurity · 4 June 2026 · 4 min read
Boards do not need a threat briefing. They need to know which risks are being accepted, by whom, and what would change their mind.
Read the article