Articles

STRIDE for AI systems

Applying STRIDE to LLM and agentic applications: what each category means when untrusted text can act as instructions, where STRIDE stops covering multi-agent failure modes, and the controls per element.

Prompt injection defence

Why prompt injection cannot be filtered away, why it has no full fix yet, and how to design AI systems — architecturally, not just with better prompts — so a successful injection has no useful consequence.

LLM security controls

A control checklist for enterprise GenAI: data handling, retrieval isolation, agent authority, cascading-failure containment, monitoring, cost limits and vendor terms.

EU AI Act readiness

A practical sequence for AI Act readiness: inventory, classification, obligations mapping, documentation and human oversight evidence — plus the current state of the Digital Omnibus timeline changes.

Identity attack paths

Using BloodHound and Entra ID review to find privilege escalation paths across on-premises Active Directory and cloud identity.

Conditional Access baseline

An Entra ID Conditional Access baseline ordered by blast radius: which policies to ship first, how to stage them, the legacy-policy retirement dates that create silent gaps, and the exclusions that quietly undo them.

From CSPM alerts to fixes

A CSPM tool produces thousands of findings. This is the triage and ownership model that converts that backlog into a small number of changes that matter.

Multi-cloud baseline

How to express a single set of security requirements — including AI workload guardrails — across Azure, Google Cloud and Alibaba Cloud without maintaining three unrelated standards.

DORA, NIS2 and the AI Act

A control-level comparison of DORA, NIS2, the EU AI Act, ISO/IEC 42001 and ISO 27001 — what you can evidence once and reuse across all of them.

IR playbooks that work

A playbook structure built for 03:00 use: decision points, containment options with trade-offs, evidence steps and the exact notification clocks under DORA, NIS2 and GDPR.

Tabletop exercises

How to design and facilitate a security tabletop that surfaces decision gaps instead of confirming that everyone has read the policy, and how it fits DORA/NIS2 testing obligations.

OSINT exposure awareness

What OSINT reconnaissance actually finds about an organisation and its executives, how AI voice cloning changes the pretext, and the awareness training that measurably reduces exposure.

Three layers, three risk profiles

A security review that skips naming its layer — model, service, or agent — ends up testing the wrong attack surface.

Deleting model data

Why trained data is hard to remove from LLM weights, and how incident responders should contain, replace and test an affected model.

Context window structure

Why mixing data and instructions in the same context window causes prompt injection, and how 'lost in the middle' behavior degrades operational security.

Tokenization and filter bypass

Content filters match on words; models read tokens. Spacing, encoding and hidden characters change tokenization and can slip content past the filter.

Sampling controls

Temperature and top-p shape repeatability. Treat them as versioned security settings if AI outputs must be tested, audited or reproduced.

Vector stores as assets

Document embeddings are not one-way hashes, and vector databases require access controls. How chunking strategies dictate data exposure in AI systems.

Reversibility by layer

When an AI system misbehaves, the available fix depends on which layer caused it. Prompt and RAG context are cheap to correct; fine-tuned weights are not.

Retrieval poisoning

A poisoned RAG document can turn retrieval into prompt injection. See how ingestion, ranking, permissions and testing contain the attack.

Agentic threat models

Why the shift from generative query-response to an autonomous agentic loop changes the threat model of an AI system from bad output to unintended action.

Containing compromised agents

An agent will eventually be tricked, mistaken, or hijacked. Five architectural controls decide what it can still do when that happens.

Agent blast radius

A bad model decision becomes an incident through tool calls. Agent memory determines how long and how far the damage can spread.

Multi-agent teams

Splitting tasks across specialized AI agents multiplies capabilities but creates a broader attack surface. Learn how to secure the protocols connecting them.

Disclosure as a control

Telling users they're talking to AI, and labeling synthetic audio and video, works as an operational defense against AI-accelerated phishing and fraud.

AI risk map

Eight places where AI systems retain, transform or expose data—and the questions that reveal whether each one is controlled.

From Threat Modeling to a General Principle

Thoughts on threat modeling

What contains a CLI agent

Four failure modes, the profile that answers them, and why enforcement can't live inside the agent's own instructions.

Seatbelt, container, VM

Which failures each isolation layer contains, five container defaults that delete the boundary, and which kind of VM is a real one.

Where the credential lives

Two shapes of agent isolation, the one that keeps keys out of the process, and the failure both shapes still miss.