Nine frameworks laid over one another, control by control, with every mapping judged by hand rather than generated. The disagreements are the interesting part.
Open the mesh Tools that answer somethingSmall, sharp instruments: which AI framework applies to you, where two frameworks stop agreeing, what a control's policy has to contain, and an assessor who argues back.
See the tools WritingEssays on where AI governance is going, why most of it has no teeth, and the parts of security practice that transfer straight across.
Read the writingAPP 1.7 starts on 10 December 2026. What the test actually says, why a person in the loop rarely takes a system out of scope, why the OAIC names fraud and security tools, and what security needs to hand legal before the deadline.
May 9, 2026AI Security Isn't a Feature. It's the Whole Game Now.Zero-click prompt injection on production LLMs, why prompt injection is architectural not patchable, securing RAG and MCP, excessive agency as least privilege, governance with enforcement, and operating at machine speed.
April 24, 2026Slowness Is the Vulnerability Nobody PatchesTime is the real attack surface now. Why MTTD/MTTR are existential, how to move from spatial to temporal architecture, where to automate without blowing up like CrowdStrike, and what to actually measure when the adversary runs at machine speed.
Eight chapters on why the people who already know how to govern things nobody fully understands are the ones who should be governing AI.
Everything on this site is free to use, and stays that way. The one thing I sell is the book. If you want to argue with any of it, or you are putting a program together and want a second opinion, write to me.
