Insights
Long-form articles, guides and field notes on AI engineering, sovereignty, compliance and the human side of security.
Every AI option buys three things at once: a capability, a dependency and an option on the future. A decision method with three gates, a three-year cost model that includes leaving, explicit lock-in and sovereignty scores — and why the honest answer is usually a hybrid.
On 4 September 2026 the Rhysida group published 1.44 million files from two Berlin Senate administrations after the state refused a 30-bitcoin ransom. Refusing was right. What made it expensive was decided years earlier: identity, segmentation, data hygiene, egress monitoring and a consolidation that never happened.
Frontier models turned expert attention — the scarce input on both sides of cyber security — into a metered commodity. What that changed for attackers and for defenders, why the exploit window collapsed to hours, and why "nobody is looking at our custom code" stopped being a defence.
A portfolio method for AI use cases: four value mechanisms and how much of each reaches the profit and loss, a business case built on measured baselines and an honest adoption assumption, a value–feasibility map with the AI Act drawn on it — and the business-development half most strategies forget.
A translation of the Digital Operational Resilience Act from legal text into engineering requirements — ICT risk, incident reporting, resilience testing, third-party risk — with what it means for teams that build and run AI and platform systems.
Sovereignty is decided in architecture, not in contracts: where data physically lives, which law can reach it, who holds the keys, and whether you can leave. A design method for EU-conform AI and platform hosting.
Why most production failures of LLM systems are context failures, how tokenization shapes cost and quality, and a practical method for designing context windows as deliberately as you design a database schema.
The classic social-engineering tactics, what generative AI has changed about them, why annual awareness training does not move the numbers, and how behaviour assessments and designed workflows do.