Search
Found 5 articles
AI Supply Chain Poisoning: When the Risk Hides in Models, Data, and Tools
An AI system's supply chain is far more complex than traditional software: model weights, training data, dependencies, external tools (MCP), and even prompts themselves can be tampered with. This article breaks down five links, why detection is so hard, and five practical defensive principles.
Cloud Identity and Permissions: Where the New Access Cards Live
When workloads move to the cloud, credentials change shape entirely: no longer usernames and passwords but service principals, roles, temporary credentials, and CI/CD secrets. This article explains four concepts, five common blind spots, and a practical order for tightening things up.
Insider Threat and Access Governance: The Hardest Attack Surface Is Inside
Insider threat is not simply "having a bad actor": it covers three distinct types — malicious, negligent, and coerced — each needing different countermeasures. This article breaks down their behavioural signatures and detection logic, and why access governance beats employee surveillance.
Supply Chain and Third-Party Risk: When Your Attack Surface Is Not in Your Own Building
Much of a modern enterprise's attack surface sits outside its own control: open-source packages, outsourced providers, cloud dependencies, SaaS tools. This article unpacks the risk mechanics of four supply-chain links, shows how attackers borrow a path in, and includes a third-party risk checklist you can use directly.
Zero Trust Architecture: Not a Product Purchase but a Change of Assumption
In vendor decks, "zero trust" often becomes a product name; fundamentally it is only a change of assumption — no longer assuming the inside is safe. This article unpacks three core principles, four implementation layers, five common misconceptions, and why it is the same work as credential governance and insider threat management.