Insights
Practical writing on the work we do — security testing, AI systems, and building software that holds up. No thought-leadership filler; just what we have found to be true in practice.
Start here
- AI & Engineering10 min read
What Breaks When You Put an AI Agent in Production
Agent demos are easy; agents with real credentials on real systems are hard. Compounding errors, prompt injection, idempotency, audit logs and earned autonomy.
Read - AI & Engineering9 min read
Why Your RAG System Gives Confidently Wrong Answers
RAG failures are usually retrieval failures wearing a prompt-engineering costume. Chunking, embedding mismatch, stale indexes, missing re-ranking, and permissions.
Read - Cybersecurity10 min read
API Security: The Failure Modes That Actually Show Up in Testing
Authorisation is where APIs break. A tester's walk through BOLA, function-level gaps, over-exposed objects, mass assignment and enumeration — with examples.
Read - Cybersecurity10 min read
What Actually Happens During an ISO 27001 Certification Project
Not a checklist you complete once. A walkthrough of the real phases — gap assessment through Stage 2 audit — and why most stalled projects stall for the same reason.
Read - AI & Engineering10 min read
RAG or Fine-Tuning? A Decision Guide That Isn't Hand-Waving
RAG is for knowledge that changes, must be cited, or is permission-scoped. Fine-tuning is for behaviour and format. A practical decision framework, with failure modes.
Read - Cybersecurity9 min read
VAPT vs Vulnerability Scanning: What the Difference Actually Means
A scanner finds known CVEs across your whole estate. It cannot find a broken authorisation check. Here is what each one buys you, and when to buy which.
Read
Everything we have published
- AI & Engineering9 min read
Chatbot or Agent? What You're Actually Asking a Business to Build
Most businesses that ask for an AI agent need a well-grounded chatbot. A practical way to tell the difference before you commit to the wrong build.
Read - Cybersecurity9 min read
Mobile App Security Testing: What It Actually Covers, and Why It Isn't Web Testing With Extra Steps
Local storage, certificate pinning, binary hardening, MASVS — and the uncomfortable fact that most 'mobile' findings are really backend API bugs.
Read - AI & Engineering9 min read
Where AWS Bills Actually Come From, and the Fixes That Don't Hurt Reliability
Idle instances, orphaned volumes, and missing Savings Plan coverage drive most AWS overspend. A practical guide to cutting waste without touching redundancy.
Read - AI & Engineering9 min read
Cross-Platform or Native? A Decision That's Cheaper to Make Once
React Native, Flutter, or Swift and Kotlin — the right call depends on your team and your features, not on which framework is fashionable this year.
Read - Cybersecurity9 min read
Incident Response Readiness: What to Have Before a Breach, Not During One
The decisions that determine how bad a breach gets are made in the first hour, by whoever happens to be in the room. Readiness means that hour is already planned.
Read - AI & Engineering9 min read
Which Shortcuts to Take When Building an MVP (and Which Will Cost You)
An MVP is a bet on speed. Some shortcuts are correct engineering; others quietly become rewrites. A specific, opinionated guide to which debt is safe to take on.
Read - Cybersecurity9 min read
The Enterprise Security Questionnaire: A Startup's Field Guide
Your first enterprise prospect just sent a 200-row security questionnaire. Here is what it is, what to say when the answer is no, and what to fix first.
Read - Cybersecurity9 min read
Perimeter vs Internal Security: Why a Firewall Audit Isn't Enough
A firewall audit tells you the front door is locked. It says nothing about what happens once someone is already in the building. Here is the difference.
Read
Have a question these articles didn't answer?
Most engagements start as a specific technical question. Send us yours and we'll give you a straight answer, whether or not it turns into a project.
Ask our team