Nine frameworks laid over one another, control by control, with every mapping judged by hand rather than generated. The disagreements are the interesting part.
Open the mesh Tools that answer somethingSmall, sharp instruments: which AI framework applies to you, where two frameworks stop agreeing, what a control's policy has to contain, and an assessor who argues back.
See the tools WritingEssays on where AI governance is going, why most of it has no teeth, and the parts of security practice that transfer straight across.
Read the writingZero-click prompt injection on production LLMs, why prompt injection is architectural not patchable, securing RAG and MCP, excessive agency as least privilege, governance with enforcement, and operating at machine speed.
April 24, 2026Slowness Is the Vulnerability Nobody PatchesTime is the real attack surface now. Why MTTD/MTTR are existential, how to move from spatial to temporal architecture, where to automate without blowing up like CrowdStrike, and what to actually measure when the adversary runs at machine speed.
April 7, 2026The Philosophy Problem Nobody in AI Security Wants to Talk AboutWhy AI security debates keep hitting philosophical fault lines: undefined agent identity, probabilistic truth, non-deterministic behaviour, and governance models that still assume predictable human-operated systems.
Eight chapters on why the people who already know how to govern things nobody fully understands are the ones who should be governing AI.
Everything on this site is free to use, and stays that way. The one thing I sell is the book. If you want to argue with any of it, or you are putting a program together and want a second opinion, write to me.
