I've spent the week watching people argue about whether AI will replace security analysts whilst ignoring the fact that most organisations still can't tell you where their crown jewels are stored. Priorities remain wonderfully intact. Broadcom's Breakup Strategy Allstate tried to leave VMware. Broadcom immediately audited them, then sued them for leaving during the audit. … Continue reading Breach of Confidence — 17 July 2026 →

A few years ago, my friend Jim Shields wrote a book called Three Guys Walk Into a Bar. The basic premise is that there are three kinds of people. There is a guy. You need a wall painted, so you find a guy. Any reasonably competent person with a brush, a ladder and enough spatial awareness not … Continue reading What Happens When Someone Mentions Your Name? →

I've started replying to emails with 'sorry, Claude ate it' and people seem to accept this without question. We truly live in remarkable times. Claude Desktop becomes a sleeper agent Red teamers compromised an email inbox, synced a malicious prompt across Claude Desktop, and turned the AI into a puppet that executed commands on the … Continue reading Breach of Confidence: 10 July 2026 →

I spent most of this week explaining to people that 'human in the loop' doesn't mean what they think it means. It's not governance. It's liability assignment with extra steps. Anyway, here's what happened whilst we were all pretending AI would solve our problems. --- MCP 2.0: stateless and chaotic They've fixed the old problems … Continue reading Breach of Confidence — 03 July 2026 →

I was meant to post this Friday, but the day got away from me. Then I was waiting to watch the England match, and now relieved that they secured a win, I'm free to post in clarity. Fortibleed keeps bleeding Fortinet's official story doesn't quite match what the logs are saying. Turns out 75,000 firewalls … Continue reading Breach of Confidence — 26 June 2026 →

OK it didn't <really> do that. But I'm in a ranty mood. So if you're looking for a well thought out post, you're in the wrong place today my friend. I've spent twenty years telling people that security is a shared responsibility, that we're all in this together, that with the right controls and a … Continue reading The Security Industry Stole My Motorbike →

I've spent the past week explaining to various family members that no, I cannot just 'hack into' their neighbour's Ring doorbell because the tree dispute has escalated. Here's what happened whilst I was declining to become a cyber-criminal. The CEO's Little Black Book A chief executive kept all 2,000 employee passwords in a desktop Excel … Continue reading Breach of Confidence: 19 June 2026 →

This week I think I'd like a refund on my optimism. The Doxxer Gets Doxxed Someone in Spain leaked the personal details of police, prosecutors, and cyber officials across multiple platforms. They got arrested in Granada last week. The poetic justice of doxxing the very people tasked with preventing doxxing is absolutely chef's kiss. https://therecord.media/spain-arrests-suspected-hacker-for-publishing-data-on-sensitive-government-workers … Continue reading Breach of Confidence — 12 June 2026 →

I've spent the week watching people try to solve human problems with technical solutions and technical problems with human rage. Neither works as well as you'd think. Also, while I was speaking at infosec about the latest AI threats people need to be wary of, my motorbike which was in the "secure" ExCel car park … Continue reading Breach of Confidence: 05 June 2026 →

I see many job postings asking for someone who is 'passionate about cybersecurity.' Enthusiastic. A team player. Positive attitude preferred. And maybe I'm being a bit click-baity here, but they're hiring for the wrong thing entirely. The person you actually want exhibits the following: Upon receiving a beautifully wrapped gift, immediately wonders who sent it … Continue reading Are we hiring for the wrong thing? →