Topics

Eight areas of modern IT and security. Each field note is published to one topic. Follow a topic to see it first, or take its feed.

• Architecture and strategy

  Security architecture has moved from walls to identity to a shared fabric of controls, and is now moving towards systems that sense and act on risk by themselves. Most organisations run several stages at once, so the work is deciding which part of the estate needs which stage.

  3 field notes · Latest: Post-quantum migration starts with a cryptography inventory (26 October 2026)
• Identity and access

  Identity has become the control point: access is decided by who or what is asking, not where it sits. The hard parts now are the accounts nobody owns, including service accounts, API keys and the identities AI agents use, and keeping access in step with how people actually move through an organisation.

  4 field notes · Latest: Governing AI agents: keep the record, expire the access (21 October 2026)
• Network and segmentation

  Segmentation limits how far an intruder can travel, but it stalls when nobody can say what a workload is. Labels that describe applications, environments and roles come first, and the rules that follow from them are much simpler to write and to test.

  5 field notes · Latest: DNSSEC: why it exists, who uses it and what it has broken (27 October 2026)
• Exposure and threat

  The shift is from counting vulnerabilities to managing exposure: which weaknesses can actually be reached and used, on the things the business cares about. Continuous threat exposure management is a way of working that joins scoping, discovery, prioritisation, validation and mobilisation, not a single product.

  1 field note · Latest: Vulnerability counts are the wrong number (19 October 2026)
• Data protection

  Data protection means knowing where sensitive data lives, how it moves and who can take it, then stopping loss without stopping work. Generative AI has added a new route out, because prompts and uploads carry data to places older controls never watched.

  1 field note · Latest: DLP after generative AI: the leak is now a prompt (19 October 2026)
• Cloud and platforms

  Cloud security is decided mostly by how platforms are built and run, and less by the tools bolted on afterwards. Shared responsibility still fails at the seams between what the provider secures and what the customer configures, and platform engineering is where those defaults get set.

  1 field note · Latest: Shared responsibility still fails at the same seam (19 October 2026)
• AI

  AI touches security twice: as a system to be secured, with new data, supply chain and agent risks, and as a tool for defenders and attackers alike. The common thread is that models, plugins and agents act with real access, so they need the same ownership, limits and monitoring as any other privileged actor.

  4 field notes · Latest: The AI supply chain: models, plugins and tool servers as third parties (29 October 2026)
• Resilience and regulation

  Regulators now ask whether important services can keep running through disruption, including disruption at suppliers, and not only whether controls exist. In the UK and EU that means operational resilience rules, DORA and a close look at third-party dependencies.

  1 field note · Latest: DORA in practice: what the third-party register reveals (19 October 2026)

Personal work and my own view, not my employer's. Sources are public.