I spent most of this week explaining to people that 'human in the loop' doesn't mean what they think it means. It's not governance. It's liability assignment with extra steps. Anyway, here's what happened whilst we were all pretending AI would solve our problems. --- MCP 2.0: stateless and chaotic They've fixed the old problems … Continue reading Breach of Confidence — 03 July 2026 →

I was meant to post this Friday, but the day got away from me. Then I was waiting to watch the England match, and now relieved that they secured a win, I'm free to post in clarity. Fortibleed keeps bleeding Fortinet's official story doesn't quite match what the logs are saying. Turns out 75,000 firewalls … Continue reading Breach of Confidence — 26 June 2026 →

OK it didn't <really> do that. But I'm in a ranty mood. So if you're looking for a well thought out post, you're in the wrong place today my friend. I've spent twenty years telling people that security is a shared responsibility, that we're all in this together, that with the right controls and a … Continue reading The Security Industry Stole My Motorbike →

I've spent the past week explaining to various family members that no, I cannot just 'hack into' their neighbour's Ring doorbell because the tree dispute has escalated. Here's what happened whilst I was declining to become a cyber-criminal. The CEO's Little Black Book A chief executive kept all 2,000 employee passwords in a desktop Excel … Continue reading Breach of Confidence: 19 June 2026 →

This week I think I'd like a refund on my optimism. The Doxxer Gets Doxxed Someone in Spain leaked the personal details of police, prosecutors, and cyber officials across multiple platforms. They got arrested in Granada last week. The poetic justice of doxxing the very people tasked with preventing doxxing is absolutely chef's kiss. https://therecord.media/spain-arrests-suspected-hacker-for-publishing-data-on-sensitive-government-workers … Continue reading Breach of Confidence — 12 June 2026 →

I've spent the week watching people try to solve human problems with technical solutions and technical problems with human rage. Neither works as well as you'd think. Also, while I was speaking at infosec about the latest AI threats people need to be wary of, my motorbike which was in the "secure" ExCel car park … Continue reading Breach of Confidence: 05 June 2026 →

I see many job postings asking for someone who is 'passionate about cybersecurity.' Enthusiastic. A team player. Positive attitude preferred. And maybe I'm being a bit click-baity here, but they're hiring for the wrong thing entirely. The person you actually want exhibits the following: Upon receiving a beautifully wrapped gift, immediately wonders who sent it … Continue reading Are we hiring for the wrong thing? →

The film industry is running out of ideas. I know this because they have made 10 (20?) films about a group of people who drive cars aggressively (sometimes into space) and called it a franchise. Meanwhile, the entire cybersecurity industry is sitting here, completely unrepresented, absolutely bursting with the raw material of cinematic gold.Allow me … Continue reading Cybersecurity films that need to be made →

KB4con 2026 had Alex Honnold as a keynote speaker. He's someone who climbs extremely tall mountains with no ropes and no safety equipment. Just him, the rock, and a Wil-e-coyote style ending if anything goes slightly wrong. I have sat through a lot of conference keynotes. Former heads of state explaining that leadership is important. … Continue reading Alex Honnold and Other Keynote Choices →

Been a busy week. Stockholm is gorgeous in summer. The Ransomware Gang That Got Ransomed The Gentlemen ran their operation like McKinsey with malware. Tiered service levels, customer support, even an HR department. Then someone breached them using their own playbook. Turns out even criminal management consultants aren't immune to the fundamentals. You'd think people … Continue reading Breach of confidence: 22 May 2026 →