security
109 pieces
Field Guide to AI, Security and Cybercrime
AI Agents Are a New Kind of Insider
Insider-threat programmes look for a person with a motive. An agent holds the same access with no motive at all, and can be turned by what it reads.
Opinion · 7 min
AI Rules for a Small Business: Where to Start
You do not need a compliance department to use AI responsibly. You need four things done in order, and a page your staff will read.
Opinion · 6 min
BragJack: How a Browser Extension Hijacks Your AI Assistant's Trust
A malicious browser extension can impersonate the trusted channel between your AI assistant and its vendor, gaining its elevated privileges.
Opinion · 6 min
Deepfake Video Calls and the Payment Nobody Should Have Made
When your boss appears on a video call demanding an urgent transfer, the video is the weakest evidence in the room.
Opinion · 7 min
Email Encryption Explained: What PGP and S/MIME Do and Do Not Hide
The standard email you use is not end-to-end encrypted. Here is what the two main encryption systems protect, and what they leave exposed.
Opinion · 7 min
End-to-End Encrypted Backups: What You Gain and What You Give Up
Moving the backup key to you shuts out the provider, its breaches and legal demands. It also makes you the only recovery desk.
Opinion · 5 min
Full-Disk Encryption: Turn It On Before You Need It
The encryption built into your laptop costs nothing. Its real failure points are the recovery key and the sleeping lid.
Opinion · 7 min
Proving Who You Are Online Without Handing Over Your Face
Authentication confirms you are the same person; identity proofing demands who you are. Most services need only the first, and passkeys do it best.
Opinion · 10 min
SIM Swap Attacks: How Someone Takes Your Phone Number
A criminal persuades your mobile operator to move your number to their SIM, then uses the text messages sent to it to hijack your digital life.
Opinion · 8 min
The Lethal Trifecta: When an AI Agent Can Read, Be Steered and Send
Why combining private data access, untrusted content exposure, and external communication guarantees exploitable agents.
Opinion · 8 min
Verifying the Identity of an AI Agent You Cannot See
When an AI acts on your behalf, how does a third party know it's authorised and not a spoof?
Opinion · 8 min
When Biometric Login Fails: The Identity Lockout Problem
Biometric systems promise effortless security, but a change to your face or finger can permanently lock you out of your own accounts.
Opinion · 7 min
Account Recovery Is Your Real Password: How to Audit It
Attackers choose the weakest way back into an account, and that is rarely the login screen.
Opinion · 8 min
AI Coding Assistants and Leaked API Keys: Where Secrets Escape
Secrets now leak through context windows and logs, not only through commits.
Opinion · 9 min
AI in the Security Operations Center: What It Actually Speeds Up
Summaries and triage help analysts; autonomous response amplifies every false positive.
Opinion · 9 min
AI Red Teaming for Small Teams: A One-Week Plan
Test what your AI features can do when fed hostile content, not how rude a jailbreak can make them.
Opinion · 9 min
An AI Agent Kill Switch: Design the Stop Button First
Most deployments cannot halt one agent mid-task without killing everything else.
Opinion · Field note · 8 min
An Incident Response Plan That Fits on One Page
Plans fail on who decides and who to call, not on the technical steps.
Opinion · 7 min
Are AI Browsers Safe? The Logged-In Session Problem
An agent that browses as you inherits every account you are signed in to.
Opinion · 9 min
Broken Object Level Authorization: The API Flaw Behind Big Leaks
Change one ID in a request and read someone else's records: the most common API failure.
Opinion · 9 min
Can AI Write Malware? What Has Actually Changed for Attackers
Language models cut the cost of variation and lures far more than they invent new attacks.
Opinion · 9 min
Cloud Misconfiguration: Why Exposed Storage Keeps Happening
Drift and convenience defeat one-time audits; guardrails have to sit above individual accounts.
Opinion · 8 min
Crypto Wallet Drainers: The Signature You Did Not Read
Drainers rarely steal seed phrases; they get you to sign a permission that outlives the session.
Opinion · 8 min
Cyber Incident Reporting Deadlines: Several Clocks, One Incident
A single breach can trigger 24-hour, 72-hour and materiality-based deadlines to different regulators.
Opinion · 9 min
Deepfake Job Candidates: Remote Hiring Is Now an Identity Problem
The interview has become an authentication step, and most hiring teams never designed it as one.
Opinion · 9 min
Digital Legacy: Planning Your Accounts and Photos After Death
Setting up legacy contacts and password inheritance ensures your family can access or close accounts without legal gridlock.
Opinion · 9 min
Fake CAPTCHA Scams: Never Paste What a Website Tells You To
ClickFix pages turn the visitor into the installer, bypassing every filter in between.
Opinion · 10 min
GPS Spoofing Explained: When Location Data Lies
Jamming announces itself; spoofing keeps the map calm and confident while it moves you somewhere else.
Opinion · 7 min
Help Desk Social Engineering: The Password Reset Phone Call
A convincing caller asking IT for a reset has become the easiest way past strong authentication.
Opinion · 8 min
Home Router Security: The Settings That Don't
Hiding the network name changes nothing; the admin password, updates and remote management change almost everything.
Opinion · 10 min
How to Know If Your Phone Is Hacked: Signs That Actually Matter
Battery drain and heat are mostly noise; account-level evidence is where compromise shows.
Opinion · 8 min
Infostealer Malware: Why a Stolen Cookie Beats a Stolen Password
After an infostealer, changing passwords is not enough; sessions must be killed everywhere.
Opinion · 9 min
Initial Access Brokers: The Market Behind a Ransomware Attack
The intrusion you suffer was often bought, and your leaked logins set the price.
Opinion · 8 min
Insider Threat in Remote Teams: Signals Without Surveillance
Watching access and data movement works better than watching employees.
Opinion · 9 min
Internet-Exposed PLCs: Why Small Utilities Keep Getting Hit
Attacks on water systems exploit defaults and exposure, not sophistication.
Opinion · 8 min
Juice Jacking: Is Public USB Charging Actually Dangerous?
The famous warning is mostly theory; the smaller real risk is tapping Trust on a prompt.
Opinion · 8 min
Keyless Car Theft: Relay Attacks and What Actually Stops Them
A signal-blocking pouch works only on the nights you remember it; layers the relay cannot reach work every night.
Opinion · 9 min
MCP Server Security: A Config File Is Now Executable Code
Cloning a repository can launch tools with your privileges before you have read a line.
Opinion · 9 min
Non-Human Identities: The Credentials Nobody Owns
Service accounts, API keys and tokens outnumber people, and most have no owner or expiry.
Opinion · 8 min
Phishing Kits That Bypass MFA: A Subscription Business
Adversary-in-the-middle phishing is sold with dashboards, updates and support.
Opinion · 8 min
Phone Stolen? The First 30 Minutes, in Order
Thieves who watched your passcode are after your accounts, not the handset.
Opinion · 8 min
QR Code Scams (Quishing): Why a Sticker Beats Your Spam Filter
QR codes move a link out of screened channels and onto an unmanaged phone, often in the physical world.
Opinion · 9 min
Ransomware as a Service: How the Criminal Franchise Works
Brands come and go; affiliates, brokers and negotiators stay in business.
Opinion · 8 min
Running a Local LLM for Privacy: What You Gain and What You Don't
Local models remove the provider from the picture, not the risks of what the model is allowed to do.
Opinion · Field note · 8 min
Setting Up a Child's First Phone: Contact Controls Before Content
The biggest risk on a first phone is who can reach the child, not what they might see.
Opinion · 8 min
Should Open-Weight AI Models Be Regulated?
Weights cannot be recalled once published, which forces regulation to look somewhere else.
Opinion · 8 min
Should You Pay a Ransomware Demand? The Case Against Certainty
Payment buys a promise from a counterparty with no reason to keep it.
Opinion · 8 min
Slopsquatting: When AI Invents a Package, Someone Registers It
Hallucinated dependency names repeat across users and sessions, which makes them predictable targets.
Opinion · 10 min
Small Business Cybersecurity: The First Five Things, in Order
Before buying any product, a small firm needs five unglamorous controls done properly.
Opinion · 8 min
Vibe Coding Security Risks: The Check That Was Never Written
AI-generated apps rarely fail through exotic bugs; they fail through omissions nobody asked for.
Opinion · 8 min
What Is Prompt Injection? Why It Is Not Like SQL Injection
The comparison suggests a patch exists; the architecture says otherwise.
Opinion · 9 min
What LLM Guardrails Can and Cannot Stop
A probabilistic filter facing an attacker with unlimited retries is a rate reducer, not a wall.
Opinion · 9 min
When AI Agents Talk to Each Other, Who Is in Charge?
Delegation chains can launder a stranger's instruction into something that looks authorised.
Opinion · 9 min
When Ransomware Hits a Hospital, It Is a Patient Safety Event
Treating a hospital cyberattack as an IT outage underprepares the clinicians who carry it.
Opinion · 8 min
Will Quantum Computers Break Encryption? What Is Actually at Risk
Public-key exchange and signatures are exposed; your AES files and hashed passwords mostly are not.
Opinion · 8 min
Zero Trust Explained Without the Vendor Pitch
Zero trust is a set of per-request decisions, and one stolen laptop tests whether you have it.
Opinion · 8 min
AI Security, Privacy and Vulnerability Index
Evasion Attacks via Adversarial Perturbations
The failure is confident, which is what removes the signal that would have caught it
Opinion · 4 min
Improper Output Handling
The moment generated code reaches a shell, it stops mattering who wrote it
Opinion · 4 min
Insecure Plugin Integrations
The assistant became the place where two estates meet, and nobody negotiated the terms
Opinion · 3 min
Supply Chain Compromises in Open-Source Model Repositories
Copying an identifier into a config is a procurement decision that nobody recorded
Opinion · 4 min
API Parameter Exploitation in Hybrid AI Models
The trusted line is the one nobody drew
Opinion · 4 min
Data Poisoning in Fine-Tuning Pipelines
A few crafted examples bend behaviour on a narrow slice while every aggregate stays flat
Opinion · 3 min
Indirect Prompt Injection in Enterprise Knowledge Bases
The payload arrives through a sanctioned route, sits inert, and fires on somebody else's question
Opinion · 4 min
Model Extraction and Reverse Engineering
A public endpoint is a slow, lossy, complete description of the thing behind it
Opinion · 3 min
Model Poisoning Against Data Poisoning
Same headline, different door, and most defences are guarding the wrong one
Opinion · 4 min
Over-Privileged Autonomous Agents
The credential was broad so the thing would work, and narrowing it now risks breaking a thing that works
Opinion · 3 min
RAG Vector Database Exploitation
The index is filed as infrastructure and behaves as memory, so write access to it is write access to what the system believes
Opinion · 3 min
System Prompt Leakage
Text kept as configuration, which behaves as documentation the moment it escapes
Opinion · 3 min
The Hidden Infrastructure of Shadow AI
An unapproved tool inherits the reach of the systems it sits upstream of
Opinion · 3 min
Other
'Military-Grade Encryption' Means Nothing
A guide to the security vocabulary that sounds strongest and tells you least
Opinion · 3 min
Age Verification and the Identity Trap
Proving you are over eighteen usually means proving exactly who you are, and the two are not the same requirement
Opinion · 3 min
AI Detectors Do Not Work, and the Cost Is Not Evenly Shared
Why classifying text as machine-written is structurally hard, and who pays when an institution pretends otherwise
Opinion · 4 min
Anonymised Is a Verb, Not a State
Removing names is the easy part, and it is almost never the part that identifies you
Supported · 3 min
Building for the Case Where You Are Compromised
Most systems are designed to prevent a breach. The interesting question is what they are worth after one.
First-person · Founder essay · 4 min
Deleting Your Account Rarely Deletes You
What the delete button reaches, what it cannot reach, and why the difference is structural
Supported · 3 min
Encrypted at Rest Is the Weakest Claim on the Page
It defends against one specific event, it is nearly universal, and it is presented as though it were the headline
Supported · 3 min
How to Read a Breach Notification
The letter is a carefully constructed document, and the interesting information is in what it declines to say
Opinion · 4 min
How to Read an Interface
A method for working out what a product optimises, using nothing but a stopwatch and a count of taps
Opinion · 4 min
Metadata Is the Message
Why who you contacted, when, and from where says more than what you said
Supported · 4 min
Passkeys Without the Marketing
What replaces the password, and the part nobody mentions until you change phones
Supported · 4 min
Public Wi-Fi: What Actually Changed
The advice everyone repeats was written for an internet that no longer exists
Supported · 3 min
The Backup You Have Not Tested Does Not Exist
Backup is a verb about restoring, and almost everybody has only done the first half
Supported · 4 min
The Cost of Being Findable
Publishing under your own name is a security decision before it is a career one
First-person · Founder essay · 4 min
The Default Is the Policy
What a system does when nobody chooses is what it does, and everything else is documentation
Opinion · 3 min
The Face Is the Password Now
Biometrics solve the problem of remembering and create the problem of not being able to change
Supported · 4 min
The Model in the Middle
When a language model sits between a person and a system, it inherits both sides' permissions and neither side's judgement
Opinion · 5 min
The Password Advice That Made Things Worse
Rules designed to increase entropy produced predictable behaviour instead, and the behaviour was foreseeable
Supported · 4 min
The Permission You Granted Once
Consent is asked at a single moment and exercised continuously, and nothing in any interface shows you the difference
Supported · 3 min
The Problem I Am Working On
Stated as a problem, because the solution is not mine to describe yet
Opinion · Founder essay · 4 min
The Supply Chain You Did Not Choose
Every dependency you install brings its own dependencies, and the trust decision was made by somebody else
Supported · 4 min
Two-Factor Authentication, Ranked
From the one that stops nearly everything to the one that is mostly a formality, with the reason for each position
Supported · 4 min
What a Model Cannot Know About Itself
Asking a system to report its own confidence, its own reasoning, or its own limits produces text, and text is not evidence
Opinion · 4 min
What a Security Audit Does Not Cover
The scope is the whole content of the finding, and it is the part left off the badge
Supported · 3 min
What a VPN Does Not Do
The three things it genuinely changes, and the many it is sold as changing
Supported · 4 min
What Happens When the Company Dies
Acquisition, insolvency and discontinuation are data events, and almost nobody plans for them
Opinion · 4 min
What I Look For When I Audit a Service
A short list, in the order I check it, and why the first item is almost always the last word
First-person · Founder essay · 4 min
What Smart Devices Send Home
A speaker that only listens for its wake word still has a great deal to say about you
Supported · 4 min
What Your Browser Extension Can See
The most privileged software on your machine is usually the software you thought about least
Supported · 3 min
Who Are You Actually Defending Against
Most personal security advice is given without asking the one question that determines whether any of it applies
Opinion · 4 min
Who Holds the Key
One question organises almost everything in practical security, and most products answer it without being asked
Supported · 6 min
Why I Publish What My Software Cannot Do
Stated limitations are expensive, which is exactly why they are worth reading and worth writing
First-person · Founder essay · 4 min
Why Phishing Still Works
It is not that people are careless. It is that the message arrives when the story already makes sense.
Opinion · 3 min
You Cannot Verify the Code You Are Running
Open source proves what was published, not what was executed, and the gap between those is where trust actually sits
Supported · 4 min
Your Password Manager Is Not the Weak Link
The objection is intuitive, common, and wrong for a reason worth understanding
Supported · 3 min
Browser-Level Encryption: What the Padlock Does Not Cover
The difference between a connection nobody can read and a file nobody can read
Supported · 4 min
Free Is a Price
What a service costs when it does not charge, and how to work out what you are paying before you sign up
Opinion · 4 min
What a Breach Actually Leaks
Why the answer to 'were passwords exposed?' matters less than people think, and what to look at instead
Supported · 4 min
What the Model Remembers
Where the text you paste into an assistant goes, who can read it, and which of the usual reassurances actually mean something
Supported · 5 min
Who Holds the Key: How files.vualet Differs From Dropbox by Design
A comparison written while one side of it is still being built, and labelled as such
Forward-looking · 4 min