What we learn in assessments, investigations and response work, written down and given away. No registration wall, no lead form — read it online or take the PDF.
An AI agent that can call tools is a new kind of privileged user: it holds credentials, takes actions with side effects, and decides what to do next from text it did not write. This report sets out a threat model for agentic systems and the controls that constrain them — written for teams shipping agents into production rather than evaluating them in a lab.
Long-form guidance on a single problem, written to be handed to a board or an engineering team.
WhitepaperThe decisions that determine whether a ransomware event is a bad week or an existential one — and which of them have to be made before the encryption starts.
WhitepaperWhat the Data Protection Act, 2019 actually asks engineering and security teams to build — translated out of legal language and into controls, logs and retention rules.
What we find repeatedly in assessments, generalised into control patterns you can apply.
Research ReportHow fraud actually enters mobile money and agent-banking platforms — social engineering, SIM swap, agent collusion, API abuse — and the control patterns that stand up to each.
Research ReportA practical threat model for systems where a language model can take actions — tool access, prompt injection, credential scope, and the audit trail you will wish you had.
An active pattern, the detections that catch it, and the controls that stop it.
Threat AdvisoryThe mailbox-rule and supplier-impersonation patterns we keep finding in finance departments, with the detection logic and the four controls that stop them.
Threat AdvisoryObject storage left world-readable remains one of the most common causes of data exposure we find. The detection and prevention controls are inexpensive and rarely switched on.
Sector-specific notes for environments with constraints the general guidance ignores.
Industry BriefA staged approach to industrial network segmentation for plants that cannot take downtime, mapped to the IEC 62443 zone-and-conduit model.
We present any of these publications as a briefing for boards, audit committees and technical teams, adapted to your own environment and the decisions actually in front of you. Ask us about a session.
