Security / Compliance
Scanners that find nothing, gates that hold, and the four layers of an AI product nobody scans. Compliance treated as evidence you can produce rather than a document you can show.
Topics
Each hub fronts one grouping of the library, with the frame it is read through, the flagship pieces, and every article in it. The full catalogue is on Research, filterable by any combination of tags; these are the doors, not the whole building.
Scanners that find nothing, gates that hold, and the four layers of an AI product nobody scans. Compliance treated as evidence you can produce rather than a document you can show.
Twenty-five years in every seat in the room, and the money language that goes with it — capital versus operating cost, what a decision actually cost, and who should have made it.
The largest body of work here. Agents that plan, call tools and change things — the stack, the guardrails, the evaluations that bite, and the failures worth reading about.
A green check is a claim. Code review that finds things, gates that hold, and the specific ways a pipeline reports health it never measured.
Working software is the measure. Agile as a slice through every layer, a definition of done that code enforces, and what AI agents change about velocity, review and the demo.
Where a workload runs is an architecture decision and a financial one. Placement, migration, the scaffolding that has to exist first, and diagrams that quietly stopped being true.
Every constraint real at once: regulated data, decades-deep integration, and a failure mode that is a person. HIPAA, HL7 and FHIR, and AI that keeps PHI inside the building.
Every cleaning rule is a claim about its consumer. Pipelines a model can trust, records joined to the right person across systems, and privacy treated as evidence you can produce.
The same dollar tells two stories. Capital versus operating cost, what AI and tooling really cost, payment and card-data rules, and the signals that decide whether an applicant is real.
Every message has two sides. The email or text a customer sees, the send and response data behind it, testing and measurement, segmentation and enrichment, and the consent rules that decide what may be sent.
The nights off from the long arc. Essays, personal stories and observations that stand on their own: a video game's background characters, the Mad Hatter, a marathon run by accident. Read them in any order.
Engage
Most of the interesting ones sit across two or three — an agentic system in a regulated environment with a migration underneath it is all four at once. Start a conversation and we will work out which.
This site: HTTPS only · no third-party trackers · no analytics cookies · security.txt
New research, projects and field notes as they publish. Following happens on LinkedIn — we never see an address, and there is nothing to unsubscribe from.
An occasional summary of new research, each with a link to the full piece.
Confirmed opt-in: we send one link to check the address is yours, and you are not on the list until you open it. Every email carries a one-click unsubscribe that removes you from the newsletter only — never from LinkedIn.