Search
Found 6 articles
AI Supply Chain Poisoning: When the Risk Hides in Models, Data, and Tools
An AI system's supply chain is far more complex than traditional software: model weights, training data, dependencies, external tools (MCP), and even prompts themselves can be tampered with. This article breaks down five links, why detection is so hard, and five practical defensive principles.
Isolated Research Practice: How to Study an Offensive Tool Safely
Studying offensive tooling is a necessary part of security work, but "researching" and "using" must be separated by technical boundaries, not willpower. Using a real isolated deployment as the example, this article covers network isolation, port binding, resource limits, tool verification, and five red lines.
The Economics of Ransomware: Why It Persists and How to Make It Unprofitable
Ransomware is not a technical problem; it is a business. Understanding its cost structure, revenue model, and risk pricing is what allows effective defence. This article analyses the business through an economic lens and explains three levers for making attacks unprofitable.
Supply Chain and Third-Party Risk: When Your Attack Surface Is Not in Your Own Building
Much of a modern enterprise's attack surface sits outside its own control: open-source packages, outsourced providers, cloud dependencies, SaaS tools. This article unpacks the risk mechanics of four supply-chain links, shows how attackers borrow a path in, and includes a third-party risk checklist you can use directly.
AI Compliance and Risk Boundaries: The Legal Checklist for Enterprise Adoption
The legal homework before AI adoption is not 'find one regulation to comply with' but inventorying the risk dimensions clearly, asking the right questions, and demanding the right documents. This article gives you an inventory framework for five risk dimensions, a question list you can take straight into the legal meeting, a vendor-document request table, and the items to add to internal policies plus per-scenario management methods.
Compliance Boundaries for Investment-Research AI: Disclaimers, Audit Trails and Traceability
When you put AI into an investment-research workflow, compliance is not one disclaimer line at the end of a report — it is a system-design problem: does the output constitute investment advice, are the data sources licensed, and can every conclusion be traced back to its inputs and prompt versions. This article gives a risk-dimension inventory, an audit-trail architecture, human-review checkpoint design, a question list to take to legal, and a route for strengthening internal policy.