Notes on data, AI, IT
and security
No marketing fog. The way I think about real problems with founders and managers.
NIS2 simplification package: where compliance becomes less paperwork
What the EU regulatory simplification package around NIS2 means for companies working with European partners or clients.
AI shifts the phishing baseline: what companies need to rethink
Generative models have reduced the cost of producing convincing phishing emails to zero. I break down how this changes the threat model and what needs to change in defence.
The CrowdStrike outage lesson: when protection becomes a single point of failure
The CrowdStrike update incident in July 2024 halted operations at thousands of companies worldwide. What it reveals about resilience architecture.
Zero trust: what it means in practice for a mid-size company
Zero trust has become a buzzword. Behind it is a genuinely useful access model - but getting there requires specific decisions, not just a policy statement.
AI assistants and identity: the new attack surface
When corporate AI assistants gain access to email, documents, and systems, a new class of threats emerges that managers need to understand.
SaaS supply chain attacks: lessons for managers
Incidents from early 2025 show that a company's security perimeter now runs through its SaaS providers. What this means in practice.
2024 in security: what changed and what stayed the same
A brief look at what 2024 added to the information security landscape - for those who make decisions, not just execute them.
Zero trust architecture: what it means in practice for a growing company
A clear explanation of zero trust as an operational security model - what changes, what stays the same, and how to approach adoption without a rewrite of everything.
NIS2: the directive starts living in practice, not just in PDFs
What NIS2 enforcement means for companies operating in the European market: who is covered, what is required, and where to start.
CrowdStrike: how one content update tears the global operational fabric
A breakdown of the July 2024 incident and what it reveals about business operational resilience.
Shadow AI tools: managing risk without banning everything
How companies can manage the risks from employees' unsanctioned use of AI tools - without making a blanket ban the only answer.
The xz backdoor: open source supply chain security is a topic for architects, not lawyers
A breakdown of the xz utils incident and why attacks on the open source supply chain change architectural requirements - not legal ones.