TECHNICAL PERSPECTIVES
Ideas that help you make the next decision.
Evidence-led notes on AI security, cryptography, identity, OT and governance—written for people who must implement the controls.
Agentic AI threat modelling: the controls outside the model
Agentic AI systems may read untrusted content, invoke tools and update business records. The primary architectural question is which actions can be authorised independently of the model.
Read article ↗AI governance / fundamentalsIntroducing enterprise AI: what should be secured first?
The first AI security control is a reliable picture of which systems have access to sensitive data, which actions they can perform and who owns the risk.
Read article ↗IAM / non-human identityWho owns an AI agent’s identity and credentials?
Autonomous agents are principals acting through technical identities. Ownership, privilege, approval and deprovisioning controls should be designed before production delegation.
Read article ↗PQC / security architecturePost-quantum readiness in Australia: the 2030 transition
A quantum-readiness plan starts with understanding cryptographic dependencies, information lifetime and vendor change constraints—not selecting one algorithm for every workload.
Read article ↗OT / critical infrastructureImproving OT security without disrupting operations
Operational environments require a safety-led delivery plan. Security control changes must be scheduled around availability constraints and engineering dependencies.
Read article ↗Assurance / executive oversightWhat security evidence gives the board confidence?
Executive assurance works when its measures support decisions. Reporting hundreds of unprioritised findings often obscures the controls that matter most.
Read article ↗