An enterprise document agent gets priced as a reader. A licence per seat, ingestion per gigabyte, an integration project, perhaps a governance workshop to reassure the records manager. What it changes, though, is not the reading; it is the nature of the estate. A document estate was never only storage. It was a system …
The hinge ended with a person doing the comparing: for example, an analyst who takes what the systems report, holds it against what is actually happening, and decides which of the two to believe. Route around that job in one place and it reappears in another. So the obvious next proposal: give the comparing to a model.…
A medieval city was never secured by its wall alone. It had guilds that vouched for their members, letters of introduction carried from town to town, gate guards who knew faces, innkeepers who noticed accents, and neighbours who registered a stranger in the lane before any official did. The wall was one instrument amon…
A friend who was at HackIT 2026 in Firenze sent me a photograph of a printed handout. Two pages, a bit creased, a faint smear of something on the second one. It was the material for a workshop called Imagining collectivity under oppression, run on the Friday afternoon in Sala M by two people going by Alecs and webbie. …
Bestuurlijke instrumenten beoordelen toestanden. Een toets, accreditatie of kader stelt vast of iets op een bepaald moment in de juiste staat verkeert, en ontleent zijn waarde aan de aanname dat die toestand stabiel blijft tot het volgende toetsmoment. Dat werkt zolang de eigenschap waar het om gaat berust op een stabi…
The usual way of reading the contest over resources is to look at where they are. Whose ground holds the oil, the gas, the rare earths, the cobalt. On that picture power follows the deposit, and the country sitting on the richest seam holds the strongest hand. It is the picture behind a great deal of the current talk a…
Everyone knows by now that Europe is rearming. That part is easy to write and carries almost nothing, because “investing in defence” survives any amount of vagueness. The interesting reading sits a little lower down, in the documents that have to name things: how much money, raised in what way, spent on what, through w…
A policy speech says what an institution wants to be seen wanting. A procurement document records what it has agreed to pay for. The two are not the same, and the gap between them is usually the more interesting reading. A press release costs nothing to write and binds no one. A call for tender names a budget, a deadli…
Er is een gewoonte in detection engineering die een organisatie tijd kost om af te leren. Een team kijkt naar de waarschuwingen, de dashboards en de dekkingsrapporten, en beschouwt die als de plek waar detectie gebeurt. Dat is niet zo. Het is de plek waar detectie zichtbaar wordt. Het werk dat bepaalt of er iets te zie…
The stability of dysfunction Many discussions of large systems quietly assume that a stable system is a healthy one, and an unstable system is a sick one. Complex systems tend to violate that intuition. They can remain operational for a very long time without becoming any healthier, and they possess several mechanisms …
Most organisations think they have a threat model. What they usually have is a historical artefact: a snapshot of how the environment looked on the day several people sat in a room with diagrams, coffee, and varying levels of optimism. The session happens. Assets are mapped. Threats are identified. Risks are scored. A …
Organisations invest heavily in procedures, certifications, and standards. Yet whether those investments deliver results depends on something far less tangible: human relationships. As organisations become more distributed and interdependent, seeing and strengthening these connections becomes critical to resilience. Th…
When scenario planning practitioners and others speak of “looking forward”, they don’t mean prediction. Forecasting implies we know where we’re going, while scenario planning admits we do not. Looking forward is not clairvoyance, nor is it the worship of trend graphs. It is not about guessing which shiny technology or …
A developer pushes a feature. Security flags a missing TLS configuration. Operations scrambles to patch the database. Alerts multiply while emails ping insistently and no one knows who owns what. Technical pipelines are fine. The human side stutters. Miscommunication, conflicting priorities, and unspoken assumptions sl…
The internet is fundamentally broken. The question now is: what can we do? The answer is messy, expensive, and occasionally involves telling very powerful people that their business model is morally questionable. Accepting the obvious First, acknowledge the unpleasant truth: there is no quick fix. Security is not a fea…
Once upon a time, the internet was described as an “information superhighway”. In truth, it more closely resembles the back alley behind a funfair: noisy, sticky underfoot, and populated by people selling things you probably do not want but will end up buying anyway. It is not defendable in any serious sense, and the e…
Programming can be serious business, buffer overflows, privilege escalations, and command injections can ruin your day (or your server). But what if we let the code speak for itself? Imagine strcpy whispering, “I will politely overflow your stack”, or a rogue Python pickle.loads grinning, “I will happily instantiate wh…
Europe likes to think it is safe and secure. In reality, much of its critical infrastructure is running on borrowed time. Old systems, fragmented responsibility, and perverse incentives have left a security debt that, if left unpaid, could affect millions of lives. Some sectors carry heavier debt than others, and the c…
The trouble with governments and cryptography is that they keep mistaking mathematics for magic. In Ankh-Morpork, this was the sort of thinking that once led the Wizards of Unseen University to try and regulate gravity, on the grounds that it was “inconvenient.” It ended, inevitably, in bruises. In our world, the same …
The US National Vulnerability Database has slipped from a dull but dependable piece of security plumbing into a sputtering liability. Enrichment of CVEs has stalled, backlogs have exploded, and defenders are left with raw identifiers instead of usable intelligence. This collapse is not accidental, it is the predictable…
David Clark remembers the moment the Internet’s Pandora’s box creaked open and said, “Hello, world.” It was 2 November 1988, and the Morris Worm was slithering its way through cyberspace like a python on speed. Designed with the innocence of a curious grad student and the destruction of a cyber sledgehammer, it crashed…