Field notes

Reading risk, written down.

Practical writing on cybersecurity, AI governance, and the risks that live in the systems organizations actually run — with labs and artifacts you can use.

17 Jul 2026

AI Governance ISO/IEC 42001 AI Agents

Governing the AI Agent: ISO/IEC 42001 When an Action Cannot Be Undone

A single poisoned support ticket, and ninety seconds later a production server was gone. Explore five ways an AI agent that takes actions can fail by moving money, deleting servers, or following a document, along with the ISO/IEC 42001 control that addresses each one, plus a lab you can run and intentionally break.

Read the post

9 Jul 2026

AI Governance ISO/IEC 42001 RAG Security

Governing the Enterprise RAG Copilot: A Practical Start with ISO/IEC 42001

An internal copilot leaked the CEO's salary to an ordinary staff account. Here are five ways an enterprise RAG copilot goes wrong, the ISO/IEC 42001 control that stops each one, and a working lab you can download, run, and break yourself.

Read the post