I am inviting you to the Indigo Observatory, a peculiar corner of the internet where current events get filtered through Discworld metaphors, and where watching the status quo maintain itself becomes both entertaining and only slightly depressing. If you are looking for breathless enthusiasm about how technology and po…

Europe has suddenly declared that hundreds of thousands of companies must meet demanding NIS2 cybersecurity standards, yet the pool of qualified auditors is tiny in comparison. Critics note there’s a shortage of qualified auditors to perform the required assessments, the compensation for auditors is too low, and the au…

An uncomfortable truth: Every byte uploaded to AWS, Azure, or Google Cloud isn’t just data, it’s cloud capital. Coined by economist Yanis Varoufakis, the term captures how tech giants transform digital activity into privatised infrastructure. It’s not merely about hosting files; it’s about hoarding power. And right now…

Organisations invest heavily in procedures, certifications, and standards. Yet whether those investments deliver results depends on something far less tangible: human relationships. As organisations become more distributed and interdependent, seeing and strengthening these connections becomes critical to resilience. Th…

When scenario planning practitioners and others speak of “looking forward”, they don’t mean prediction. Forecasting implies we know where we’re going, while scenario planning admits we do not. Looking forward is not clairvoyance, nor is it the worship of trend graphs. It is not about guessing which shiny technology or …

A developer pushes a feature. Security flags a missing TLS configuration. Operations scrambles to patch the database. Alerts multiply while emails ping insistently and no one knows who owns what. Technical pipelines are fine. The human side stutters. Miscommunication, conflicting priorities, and unspoken assumptions sl…

Introduction A SOC alert does not knock politely. It arrives like a crowd of people shouting different instructions in a language only half understood. One alert maybe says “ransomware detected,” another could flag “unusual login,” and the logs you trust most are blank. Analysts glance at dashboards, shrug, and whisper…

There is a certain bleak poetry in a security audit. The word audit evokes clipboards, compliance spreadsheets, and the faint smell of burnt patience. But beneath the bureaucracy lies something far more interesting: an act of seeing. A real audit, not compliance theatre, but the kind that leaves everyone quietly re-eva…

If you have ever tried to set up a Security Incident Response Team (SIRT) function in a small organisation, you will know that it is not about security, incidents, or even teams. It is about humans behaving badly under stress. Enter the Satir Change Model, a tool from family therapy that has no right working in cyberse…

Ever received that little gem of an email from IT: “Compliance Reminder”? No greetings, no sugar-coating, just a tiny, accusatory phrase in your inbox like a foghorn in a library. And just like that, the office collectively holds its breath. Instantly, a strange ritual begins. Even the most relaxed of colleagues, those…