A client conversation this week in financial services turned, as these things do, into a proper deception technology deep dive. Who's still standing, what the category actually means now, and what to ask before anyone signs anything. Figured it was worth getting down properly rather than letting it
A note before you read: this was written in July 2026 in response to the first confirmed case of an AI model escaping a testing sandbox and breaching a third party's systems. Since then, there has been a second OpenAI sandbox escape in September, a reported Anthropic incident
Your English-Lit cheat sheet for the Hacker Halted keynote. No exam. You don't need to know your Shakespeare. That's my job for the next fifty minutes. This is just a map so you can follow along, nod knowingly at your neighbour, and take the useful
You know, I’ve been wondering what to say, or how to say it, or simply SHOULD I even say something, but sitting here looking out of the window of the metal tube that's propelling me back to a world that is broken. Good people are out of
What a Conversation About Headphone Amps Taught Me About AI Posted by Chris Roberts, Sid, AND Claude So, this is going to take a slight detour….bear with me, there's a point. A few weeks back I had a long conversation with Google's Gemini AI about
A practical guide for security leaders who are done waiting for permission to engage with the above question. Context: Frontier models, the current generation of large language models and multimodal AI systems from Anthropic, OpenAI, Google, Meta, Mistral, and others, have crossed a threshold in 2025-2026 that makes the
We arrive at the topic that organizations most commonly skip until something goes very wrong. Application security and software supply chain risk sit at the intersection of development, operations, and security, and that intersection is where some of the largest, most consequential breaches of the last decade originated. Context: Three
Cyber insurance used to be a straightforward purchase. Pay a premium, describe your controls, collect if you're breached. The market has matured painfully and significantly since then, mostly because of repeated, expensive losses that forced insurers to get serious about what they're actually covering. Context: The
Topic 11 covered how to buy vCISO and managed security services. This topic covers what happens after you buy, because that's where most programs quietly fail. Context: The security services market has a dirty secret: the relationship that gets sold is almost never the relationship that gets delivered.
Supply chain compromise has gone from an edge case to one of the dominant attack vectors of the last five years. Yet most TPRM programs are still built around the same questionnaire-and-spreadsheet model that existed before SolarWinds. Let's fix that framing. Context: Third-Party Risk Management
This is the topic nobody wants to spend money on, until they desperately need it. And then they wish they'd spent a lot more. Context: Backup and recovery used to be an IT operations concern. Ransomware made it a security-critical, board-level conversation. The question is no
Let's tackle the most over-marketed, least-understood architecture shift in modern security, and the one where vendor salesmanship has done the most damage to actual outcomes. Context: A few definitions worth pinning down before the sales pitch arrives: * Zero Trust, a philosophy and architecture principle, not a