Eighteen Minutes
How the AI Industry's Software Supply Chain Was Compromised in May 2026 Three weeks ago, between May 11 and May 18, 2026, the software supply chain that sustains the artificial intelligence industry…
The Guardia Civil 2025 Report, Read Sideways
A Quiet Benchmark for the Wrong Side In March 2026, the Unidad Técnica de Policía Judicial of the Spanish Guardia Civil published its annual cyber-intelligence report, Ciberinteligencia: Análisis y Tendencias 2025, La…
GRC, as the CISO understand It
Govern, Reassure, Confuse GRC, in the official slide, stands for Governance, Risk and Compliance. The three words are intended to describe three disciplines, each anchored to an operational substrate, each accountable to…
Imaginary Access Management
When the Policy Exists Only in the Slide Deck On Tuesday, January 14, 2026, at 8:47 sharp, Monsieur le Vicomte Jean-Baptiste de Vauquelin-Pétainville, Directeur Suprême de la Fabrique Identitaire of the Banque…
The Antivirus Is the Weapon
Inside BlueHammer, the Zero-Day That Made Microsoft Defender Promote Attackers to SYSTEM In April 2026, security researchers disclosed three zero-day vulnerabilities in Microsoft Defender. The vulnerabilities, named BlueHammer (CVE-2026-33825), RedSun, and UnDefend,…
The Shift Left Doctrine in 2026
What the Data Shows, and Who Pays the Cost In the late 2010s, the cybersecurity industry adopted a slogan: "shift left". The idea, in its original formulation, was reasonable. Catch security problems…
The Climate Fashion Week
Notes on COP30 Belém, the Belém Package, and the Genre's Signature Move In November 2025, one hundred and ninety-five Parties met in Belém, Brazil, for the thirtieth Conference of the Parties to…
Why $94 Billion in Corporate Wellness Spending Coincides With Record Burnout
A Note on the Tobacco-Yoga Industrial Complex In 2026, the global corporate wellness industry will pass $94 billion. Eighty-five percent of large U.S. employers offer a wellness program of some kind. In…
What Is a Policy
A Definition Updated for the AI Compliance Era Allow me to attempt a definition of a thing I have observed for two decades, across hundreds of corporate environments, and which has just…
Madame Colbac and the Russian Hat
A Note on Linguistic Confusion, Threat Attribution, and the Continental European Boardroom Some years ago, a senior executive at a European bank briefed her board on a cyber threat the company was…