$ ls writing/ -lt

writing.

Notes from the desk, not thought leadership. Specifics over slogans. If a piece couldn't earn its keep at a kitchen table, it didn't make it here.

Total · 95 pieces Latest · 2026·05·23 Page · 3 / 4 Locale · en_GB License · CC BY 4.0

$ grep -l tag:* | sort | uniq

agent 1 agentic 2 ai 24 annual review 1 architecture 2 attribution 2 board 10 board-portal 1 breach 1 case-study 1 children 5 ciso 1 closing 2 cni 5 concentration 1 copilot 1 craft 16 crest 2 csr-bill 1 cyber essentials 13 cyberdeck 6 deepfake 1 deployment 1 determinism 1 edtech 1 emilyai 2 enforcement 1 family 1 financial 1 gaming 1 governance 28 hardening 2 healthcare 2 hedgehog 1 home 4 honesty 1 ico 2 identity 1 incident 2 incident response 2 iot 1 ir 1 law enforcement 1 leadership 3 learning 1 llm 1 mfa 1 ned 31 open-source 1 operational 1 operator 3 patching 1 pen testing 1 plain english 12 privacy 24 provenance 1 ransomware 6 reasoning 1 reflection 2 regulation 6 regulatory 1 resilience 2 retail 1 retrospective 5 scattered-spider 1 school 1 series 51 small business 13 soc 17 social engineering 1 social media 1 sovereignty 5 spyware 1 ssh 1 staff 1 standards 2 state-aligned 1 subtraction 1 supply chain 4 supply-chain 2 synthesis 1 technical 1 third-party 1 threat-model 1 travel 3 ukcd 1 vendor 1 vulnerability 1 weekly 5 work 3 all tags → series →

2024·11·19 Passing it on: to the next director, to your children Part 18 of 18, the closing post. The privacy work you have done over the last two years has to outlive you in the role. How to write it down, how to teach it, and how to make sure the people who inherit it can actually use it. privacy · series · ned · closing 6 min 2024·11·12 AI-powered threats — and the usage policy you actually need AI is making phishing better and deepfake fraud cheaper. It is also a real risk when your own staff paste customer data into ChatGPT. Both sides of the AI coin, and a simple policy that handles both. small business · cyber essentials · plain english · series 6 min 2024·10·22 Building a personal privacy posture Part 17 of 18. Sixteen posts of specifics, condensed into a posture rather than a list. The five sentences that should govern personal privacy for a board director and their household. How to keep it current. privacy · synthesis · ned · series 7 min 2024·10·15 The basics you can pick up and walk away with: physical security and social media Screen locks, premises, disposing of old kit, USB drives, social media account security, and the risks of oversharing. The unglamorous but high-leverage controls that prevent entire categories of attack. small business · cyber essentials · plain english · series 7 min 2024·10·08 Reasoning models: what o1 changes for SOC work Post 7 of the AI series. OpenAI's o1 launched in September with a different model shape — *think longer, reason step by step*. What this means for the SOC, where the gains are real, and where EmilyAI's purpose-specific architecture continues to win. ai · soc · reasoning · series 7 min 2024·09·17 The AI year, deepfakes, and what changes for children Part 16 of 18, last of the five children-focused posts. Generative AI changed what 'a picture of a child' can mean. What parents should be alert to in 2024, what is genuinely new, and the practical conversations that still work. privacy · children · ai · deepfake · series 8 min 2024·09·10 Backups: the only thing that recovers you from ransomware The 3-2-1 rule, what to back up, why testing your backups is more important than having them, and the specific changes that protect backups from modern ransomware. small business · cyber essentials · plain english · series 6 min 2024·08·27 Single-vendor concentration: the CrowdStrike lesson applied to AI Post 6 of the AI series. The July 2024 CrowdStrike outage was not an AI incident, but it tells us a great deal about where the AI-in-security market is heading. Why single-vendor concentration of intelligent agents is a structural risk worth modelling now. ai · soc · concentration · resilience · series 7 min 2024·08·20 CrowdStrike: cyber resilience without a bad actor Four weeks after the CrowdStrike Falcon update that took 8.5 million Windows machines offline, the post-mortem is in. The interesting question is not what CrowdStrike did wrong. It is what the rest of us did wrong by assuming this kind of event could not happen. resilience · supply chain · ned · governance 7 min 2024·08·13 Malware and the layered defence Antivirus is necessary but not sufficient. The defence-in-depth approach that actually catches malware — and how it joins up with everything else we have done this year. small business · cyber essentials · plain english · series 6 min 2024·07·23 Hotels, conferences, and public Wi-Fi Part 15 of 18, third and last of the travel posts. The day-to-day mechanics — the hotel network, the conference Wi-Fi, the airport lounge, the coffee shop on the way to the meeting. The small kit and habits that compound over a year of travel. privacy · travel · ned · series 7 min 2024·07·09 Your network: Wi-Fi, routers, and home workers Your router is your only firewall. Here is how to configure it properly, secure your Wi-Fi, set up a guest network, and look after the staff who work from coffee shops and kitchen tables. small business · cyber essentials · plain english · series 6 min 2024·07·02 Open-source models and the on-prem option Post 5 of the AI series. Llama 3, Mistral, Mixtral. The serious open-source LLM era arrived in 2024. What it means for security teams who do not want to send data to a hyperscaler, and how the on-prem path reads against EmilyAI's single-tin posture. ai · soc · open-source · llm · series 7 min 2024·06·11 Patching: the unglamorous lifesaver Why software updates matter, what actually needs updating, and how to make patching manageable for a small business without dedicated IT staff. The vegetables of cyber security. small business · cyber essentials · plain english · series 5 min 2024·05·28 The hexagonal lesson: vendor agnosticism as structure Post 4 of the AI series. Most security AI products are anchored to one vendor's platform. EmilyAI was built in 2018 with a hexagonal architecture that decouples the analyst from the SIEM matrix. Six years on, the choice is paying back in a way I did not anticipate. ai · soc · architecture · series 7 min 2024·05·21 Clean devices and selective sync Part 14 of 18, second of three travel posts. The clean travel laptop and phone, what to put on them, what to leave at home, and how to remain effective without exposing the whole work footprint. privacy · travel · ned · series 7 min 2024·05·14 Email is the front door: spotting phishing and stopping BEC Over 90% of breaches begin with email. How to spot phishing, build a reporting culture, configure SPF/DKIM/DMARC, and prevent the single most expensive small business fraud: business email compromise. small business · cyber essentials · plain english · series 7 min 2024·04·23 International travel and jurisdictional risk Part 13 of 18, first of three travel posts. What actually changes when you cross a border — customs powers over devices, foreign-state interest, the practical implications of which countries you are visiting. Without the paranoid framing. privacy · travel · ned · series 8 min 2024·04·16 Locking the front door: passwords and access Password managers, multi-factor authentication, the principle of least privilege, and the leaver checklist. The single highest-value hour you will spend on cyber security all year. small business · cyber essentials · plain english · series 7 min 2024·04·09 The Copilot-for-security wave: what they actually do Post 3 of the AI series. Microsoft Security Copilot, CrowdStrike Charlotte, SentinelOne Purple, Google Sec-PaLM — the wave of LLM-powered security assistants. What they actually do well, what they do less well, and how the framing reads against EmilyAI. ai · soc · copilot · vendor · series 8 min 2024·03·19 Operation Cronos: what disruption actually achieves A month on from the NCA-led takedown of LockBit's infrastructure, the affiliate group is already back online and claiming new victims. What Operation Cronos achieved is real and worth defending — but it is not the dismantlement the headlines suggested. ransomware · law enforcement · craft 7 min 2024·03·12 What a cyber attack actually costs a small business The financial number is the smallest part. Operational disruption, reputational damage, and regulatory consequences are the costs that compound. Plus the positive case for getting this right. small business · cyber essentials · plain english · series 5 min 2024·02·27 Deterministic inference: the property the market is losing Post 2 of the AI series. Same input, same output, every time. A property that used to be table stakes in production systems and that LLM-based security tooling has quietly let go of. Why it matters and how EmilyAI is built to preserve it. ai · soc · determinism · series 7 min 2024·02·20 Board portals and document handling Part 12 of 18. Diligent, BoardEffect, Nasdaq Boards, the email-attachment habit, and the moments in board-paper handling when sensitive material is most likely to leak. The practical posture for non-executive directors. privacy · work · ned · board-portal · series 7 min 2024·02·13 Know your enemy: the threats small businesses actually face Phishing, ransomware, social engineering, malware, credential stuffing, insider mistakes, denial of service. The actual menu of threats facing UK small businesses — in plain English, without the drama. small business · cyber essentials · plain english · series 7 min

→ back to home · subscribe by email · rss