https://andy.boura.uk/blog/ Articles, talks and contributions by Andy Boura on cyber security, technology and business. en-gb Thu, 01 Jan 2026 00:00:00 +0000 https://www.aikido.dev/state-of-ai-security-development-2026 andy.boura.uk/blog/state-of-ai-security-2026 Thu, 01 Jan 2026 00:00:00 +0000 Survey report on the risk of AI-generated code. Quoted on the lack of clarity over who is accountable when GenAI code causes an incident. risk https://podcasts.apple.com/gb/podcast/an-evolution-in-the-cybersecurity-landscape/id948913991?i=1000541365159 andy.boura.uk/blog/exchanges-cybersecurity-landscape Wed, 10 Nov 2021 00:00:00 +0000 A podcast discussion with Matthew Chung and Wesley Williams on how cyber attacks have grown and how defences have adapted to new threats (about 24 minutes). risk https://www.linkedin.com/pulse/overratedunderrated-andy-boura-dr-daniel-schatz-csyp andy.boura.uk/blog/overrated-underrated Sat, 16 Oct 2021 00:00:00 +0000 An interview, with a recorded discussion, giving views on whether a series of security topics are overrated or underrated. risk https://andy.boura.uk/blog/effective-business-writing/ andy.boura.uk/blog/effective-business-writing Tue, 11 May 2021 00:00:00 +0000 Practical advice on writing for busy readers: think about the audience, keep it brief, structure it with McCarthy's 4MAT, put the bottom line up front, and make a few strong points rather than many weaker ones. communication leadership https://andy.boura.uk/blog/priority-matrix/ andy.boura.uk/blog/priority-matrix Sun, 22 Nov 2020 00:00:00 +0000 A two-step way to triage work: place each task on an importance and urgency matrix, using MoSCoW labels, then apply the tactics that suit its quadrant, so that more time goes on work that is important but not urgent. leadership https://andy.boura.uk/blog/effective-delegation/ andy.boura.uk/blog/effective-delegation Sat, 14 Nov 2020 00:00:00 +0000 A method for deliberately calibrating decision-making authority in a new role or with a new team member: sort decisions into those to inform on, consult on and escalate, then shrink the grey consult area over time. leadership https://andy.boura.uk/blog/compositional-reporting/ andy.boura.uk/blog/compositional-reporting Mon, 02 Nov 2020 00:00:00 +0000 Proposes security reporting built from short, current executive summaries that each domain expert keeps for each product, combined into overviews for different audiences, with notes on writing good executive summaries. communication risk https://www.arena-international.com/event/ebf-security-risk2019/ andy.boura.uk/blog/european-banking-forum-2019 Wed, 09 Oct 2019 00:00:00 +0000 Speaker at the London forum on balancing innovation with security in financial services, taking part in a question-and-answer session on emerging trends, risks and opportunities. risk https://andy.boura.uk/blog/shaping-your-own-luck/ andy.boura.uk/blog/shaping-your-own-luck Fri, 08 Feb 2019 00:00:00 +0000 A short personal piece arguing that much of luck is made: being open-minded and exploring finds opportunities, and knowledge, experience and preparation let you make the most of them. leadership https://mightyguides.com/andy-boura-manage-security-as-a-shared-responsibility/ andy.boura.uk/blog/security-shared-responsibility Tue, 17 Jul 2018 00:00:00 +0000 A contribution to a Mighty Guides e-book of security leaders’ advice, arguing that security works best as a responsibility shared across the organisation rather than left to the security team. risk security-architecture https://www.youtube.com/watch?v=kbO3WY0FOcQ andy.boura.uk/blog/security-by-nature Thu, 02 Feb 2017 00:00:00 +0000 A keynote linking Agile, cloud and third-party risk. security-architecture risk https://www.slideshare.net/slideshow/bdw17-london-andy-boura-thomson-reuters-does-big-data-have-to-mean-big-risks/81095681 andy.boura.uk/blog/big-data-big-risks Sun, 01 Jan 2017 00:00:00 +0000 Breach costs rising with data volume, the main sources of risk (user error, system glitches and attacks), and controls such as access management, automation and data hygiene. risk security-architecture https://www.infosecurity-magazine.com/magazine-features/prm/clevel-bonuses-cybersecurity/ andy.boura.uk/blog/c-level-bonuses-cybersecurity Fri, 30 Dec 2016 00:00:00 +0000 A feature by Sooraj Shah on whether executive pay should depend on cyber security, after MPs proposed it. Quoted on why the intent is sound but the difficulty lies in putting it into practice, and why box-ticking is not enough. risk https://www.youtube.com/watch?v=R1CqnkJ3xB4 andy.boura.uk/blog/setting-ourselves-up-to-fail Tue, 24 May 2016 00:00:00 +0000 Through the use of marketing techniques organisations can get the security awareness message over more effectively. Combined with "fallibility aware" systems design, itself part of developer and architect security awareness, we can protect systems much better than we currently do. Though if we don't follow our own rules consistently we are setting ourselves up to fail... security-awareness https://andy.boura.uk/blog/gone-phishing-passport-office/ andy.boura.uk/blog/gone-phishing-passport-office Mon, 07 Mar 2016 00:00:00 +0000 The follow-up after a call with the Director General of HM Passport Office: the suspicious text message was genuine, and the article sets out the problems in how it was sent, the risks they create, and lessons for any organisation moving services online. security-awareness security-architecture https://andy.boura.uk/blog/phishing-is-getting-too-good/ andy.boura.uk/blog/phishing-is-getting-too-good Tue, 01 Mar 2016 00:00:00 +0000 Follows a convincing text message, apparently from HM Passport Office, that linked to a third-party survey site: the warning signs, how it was checked and reported, and advice for individuals and organisations, before a plot twist. security-awareness https://andy.boura.uk/blog/security-awareness-marketing/ andy.boura.uk/blog/security-awareness-marketing Tue, 08 Dec 2015 00:00:00 +0000 Argues that security awareness should be run as marketing, with marketing's creativity, metrics, audience segmentation and specialists delivering core messages that security experts identify. security-awareness https://andy.boura.uk/blog/iot-security-ghost-ships/ andy.boura.uk/blog/iot-security-ghost-ships Tue, 20 Oct 2015 00:00:00 +0000 Argues that the bigger IoT security risk is devices their makers abandon, left unpatched on home networks, and gives advice for device designers and for consumers. security-architecture https://andy.boura.uk/blog/weakest-link/ andy.boura.uk/blog/weakest-link Thu, 21 May 2015 00:00:00 +0000 Explains, with a worked example, why security is not only as good as its weakest link: the likelihoods of separate risks combine, so several modest risks together can outweigh the weakest one. risk https://andy.boura.uk/blog/breach-costs/ andy.boura.uk/blog/breach-costs Fri, 24 Apr 2015 00:00:00 +0000 Drawing on large breaches such as Home Depot, Target and Anthem, sets out seven types of cost to consider when estimating the impact of a data breach, and argues that investing in security now makes financial as well as moral sense. risk https://andy.boura.uk/blog/biometrics/ andy.boura.uk/blog/biometrics Thu, 19 Mar 2015 00:00:00 +0000 Weighs the strengths and weaknesses of biometric authentication, prompted by Windows 10's support for it, and argues that biometrics should unlock a key held in tamper-resistant hardware rather than act as the credential themselves. security-architecture https://andy.boura.uk/blog/rc-esc-arduino-faq/ andy.boura.uk/blog/rc-esc-arduino-faq Sat, 31 Jan 2015 00:00:00 +0000 A hobbyist's FAQ on driving RC electronic speed controllers from an Arduino for multicopters: calibration and programming with the Servo library, pulse widths and timing, motor direction, and matching the ESC, motor, propeller and battery. making https://www.computing.co.uk/analysis/2436897/how-can-you-predict-the-impact-of-the-inevitable-data-breach-on-your-organisation andy.boura.uk/blog/predict-impact-data-breach Thu, 01 Jan 2015 00:00:00 +0000 Coverage of a panel at Computing’s Enterprise Security and Risk Management Summit on valuing information assets to predict the impact of a breach. Quoted on why "made-up numbers" are still worth estimating. risk https://www.youtube.com/watch?v=2flZGFulSOI andy.boura.uk/blog/effective-security-architecture Mon, 28 Jul 2014 00:00:00 +0000 For senior managers: technical debt, security architecture, and examples of designing security in from the outset (16 minutes). security-architecture risk