Notes on doing GRC deliberately.

Essays and short notes on strategy, risk, smart compliance, and the AI questions security teams actually have to answer.

Oct 2026 Can you see it, does it behave, what stops it? Why AI governance only matters once it is operational, and the three pillars (Visibility, Risk & Assurance and Protection) that get it there for AI agents. Essay · 14 min → May 2026 The DBIR 2026: three findings that deserve immediate attention Vulnerabilities overtake credentials as the top initial access vector, third-party involvement doubles again, and AI's first impact is industrialization — not innovation. Essay · 7 min → May 2026 From heat maps to decisions Heatmaps destroy the information your security stack is already generating. The fix is Decision Quality, three data sources, and a curve instead of a colour. Companion to my V2 Security 2026 talk. Essay · 8 min → Apr 2026 The timeline is collapsing faster than defenses can adapt Median time-to-exploit dropped from 771 days in 2018 to under 1 day in 2026 — AI removed the compute bottleneck. Five moves defenders should make now. Essay · 5 min →