- Governed NoOps, part 1: building software got cheap, running it must too
AI made writing software cheap but not running it, and the threat moved the other way. Part 1 of the Governed NoOps series sets out the idea and the set-up behind it.
- Governed NoOps, part 2: the paved road
Part 2 of Governed NoOps: one shared platform carries the hosting, security and patching, every change travels dev to staging to production, and the patching policy's defaults come with their reasons.
- Governed NoOps, part 3: compliance that can't go stale
Part 3 of Governed NoOps: write each fact once, next to the code it describes, generate the evidence from it, and let a test fail when the two disagree.
- Governed NoOps, part 4: manage the agent like a team member
Part 4 of Governed NoOps: running an agent well takes the same skills as leading a team. Inform, Consult, Escalate, with a second, independent actor on anything that could change the rules.
- Governed NoOps: AI-built software is now cheap; to remain secure it must be just as cheap to maintain and operate
AI has made writing software cheap but not running it. Governed NoOps points the same tools at upkeep and compliance evidence: a platform that carries the weight, compliance generated from code, and agents managed like a team, with two actors on the red lines.
- · ContributionState of AI in Security & Development 2026
Survey report on the risk of AI-generated code. Quoted on the lack of clarity over who is accountable when GenAI code causes an incident. Contribution at Aikido Security, on Aikido.
- Schrödinger's AI: Brilliant or Stupid Until Inspected
Current AI is both brilliant and stupid until you look carefully at what it produced: you find out which only by checking its work, with the knowledge to tell a useful result from a convincing hallucination.
- · TalkAn Evolution in the Cybersecurity Landscape
A podcast discussion with Matthew Chung and Wesley Williams on how cyber attacks have grown and how defences have adapted to new threats (about 24 minutes). Talk at Exchanges at Goldman Sachs, on Apple Podcasts.
- · ContributionOverrated/Underrated with Andy Boura
An interview, with a recorded discussion, giving views on whether a series of security topics are overrated or underrated. Contribution at Dr Daniel Schatz, LinkedIn, on LinkedIn.
- Effective Business Writing
Practical advice on writing for busy readers: think about the audience, keep it brief, structure it with McCarthy's 4MAT, put the bottom line up front, and make a few strong points rather than many weaker ones.
- The Priority Matrix
A two-step way to triage work: place each task on an importance and urgency matrix, using MoSCoW labels, then apply the tactics that suit its quadrant, so that more time goes on work that is important but not urgent.
- Effective Delegation through Active Calibration
A method for deliberately calibrating decision-making authority in a new role or with a new team member: sort decisions into those to inform on, consult on and escalate, then shrink the grey consult area over time.
- Compositional Reporting | Meaningful Updates in a Complex Environment
Proposes security reporting built from short, current executive summaries that each domain expert keeps for each product, combined into overviews for different audiences, with notes on writing good executive summaries.
- · TalkEuropean Banking Forum: Technology, Security and Risk 2019
Speaker at the London forum on balancing innovation with security in financial services, taking part in a question-and-answer session on emerging trends, risks and opportunities. Talk, on Arena International.
- Shaping your own luck
A short personal piece arguing that much of luck is made: being open-minded and exploring finds opportunities, and knowledge, experience and preparation let you make the most of them.
- · ContributionManage Security as a Shared Responsibility
A contribution to a Mighty Guides e-book of security leaders’ advice, arguing that security works best as a responsibility shared across the organisation rather than left to the security team. Contribution, on Mighty Guides.
- · TalkSecurity by Nature not Nurture
A keynote linking Agile, cloud and third-party risk. Talk at CISO Inspired, Inspired Business Media, on YouTube.
- · TalkDoes Big Data Have to Mean Big Risks?
Breach costs rising with data volume, the main sources of risk (user error, system glitches and attacks), and controls such as access management, automation and data hygiene. Talk at Big Data Week London 2017, on SlideShare.
- · ContributionShould C-Level Bonuses Be Linked to Cybersecurity Success?
A feature by Sooraj Shah on whether executive pay should depend on cyber security, after MPs proposed it. Quoted on why the intent is sound but the difficulty lies in putting it into practice, and why box-ticking is not enough. Contribution, on Infosecurity Magazine.
- · TalkSetting Ourselves up to Fail - The Need for Security Awareness Marketing and Consistency
Through the use of marketing techniques organisations can get the security awareness message over more effectively. Combined with "fallibility aware" systems design, itself part of developer and architect security awareness, we can protect systems much better than we currently do. Though if we don't follow our own rules consistently we are setting ourselves up to fail... Talk at Whitehall Media, on YouTube.
- Gone Phishing: a genuine text that looked like a scam, and the lessons for any organisation
A convincing text message about renewing an official document linked to a third-party survey site. The government's own phishing team said it was a scam; it turned out to be genuine. The warning signs, what went wrong, and lessons for any organisation moving services online.
- Advocating the rise of the Security Awareness Marketing function
Argues that security awareness should be run as marketing, with marketing's creativity, metrics, audience segmentation and specialists delivering core messages that security experts identify.
- IoT Security: Beware Ghost Ships and Trojan Horses
Argues that the bigger IoT security risk is devices their makers abandon, left unpatched on home networks, and gives advice for device designers and for consumers.
- Don't focus on the weakest link; correctly combine likelihoods
Explains, with a worked example, why security is not only as good as its weakest link: the likelihoods of separate risks combine, so several modest risks together can outweigh the weakest one.
- 7 Types of Breach Costs; Things to Consider When Estimating Impact
Drawing on large breaches such as Home Depot, Target and Anthem, sets out seven types of cost to consider when estimating the impact of a data breach, and argues that investing in security now makes financial as well as moral sense.
- Biometrics: The Hazards, and Mitigations, for Effective Use
Weighs the strengths and weaknesses of biometric authentication, prompted by Windows 10's support for it, and argues that biometrics should unlock a key held in tamper-resistant hardware rather than act as the credential themselves.
- FAQ for RC ESC (electronic speed controller) calibration, programming and use with Arduino for multicopters
A hobbyist's FAQ on driving RC electronic speed controllers from an Arduino for multicopters: calibration and programming with the Servo library, pulse widths and timing, motor direction, and matching the ESC, motor, propeller and battery.
- · ContributionHow can you predict the impact of the inevitable data breach on your organisation?
Coverage of a panel at Computing’s Enterprise Security and Risk Management Summit on valuing information assets to predict the impact of a breach. Quoted on why "made-up numbers" are still worth estimating. Contribution, on Computing.
- · TalkEffective Security Architecture as a Foundation for Risk Reduction
For senior managers: technical debt, security architecture, and examples of designing security in from the outset (16 minutes). Talk at Whitehall Media Enterprise Security and Risk Management Conference 2014, on YouTube.