Research / Pillar 03
What we’re watching.
We keep a small research group. Its job is to know what’s coming before it arrives: what’s moving, who’s moving it, and what it means for the people we advise.
- What it does
- Watches the ground under the other two practices. Threat activity, influence operations, the rules changing in each country we work in, and the AI systems coming into use faster than anyone is checking them.
- Where it goes
- Mostly into our advisory and AI safety work, and it stays with the client. Our own tooling keeps watch between engagements. We don’t say much about that.
- What you get here
- The part we can publish: plain-language pieces on what’s going wrong and what to do about it. Names left out. Conclusions left in.
- Governance & risk
WordPress Survival Time
How long does an unattended WordPress site last on the modern web? Minutes to be found, months to be noticed — and survival is a property of operations, not software.
- Governance & risk
Canvas LMS Breach: What Educational Institutions Should Do Now
The May 2026 Canvas breach exposed 275 million users across 8,800+ institutions. Here's what happened, immediate steps to take, and how to build long-term resilience.
- Governance & risk
Why Your AI Needs Governance Before It Needs Features
Most organizations rush to deploy AI capabilities without governance frameworks. Here's why that's a costly mistake and how ISO 42001 provides a structured path forward.
- Engineering
OWASP Top 10 for LLM Applications: A Practical Security Guide
A hands-on guide to the OWASP Top 10 risks for LLM applications, with real-world examples and mitigation strategies for each vulnerability category.
