Technical deep-dives and compliance briefings on sovereign AI privacy, ASPM and application security, vCISO practice, and EU AI Act / NIST AI RMF readiness. No vendor marketing — each post states a problem, shows the mechanism, and names the evidence an auditor will ask for.
Published in reverse chronological order.
Roughly 80% of EU AI Act high-risk obligations map cleanly onto NIST AI RMF functions. The other 20% is where audits fail. A practical evidence map, the artifacts an auditor requests by name, and how to generate them continuously instead of retrofitting them before a review.
Read article →A mid-size estate produces thousands of raw findings per month; fewer than 8% are distinct defects. How a reachability-based correlation key collapses SAST, DAST and SCA noise into a work queue a team can finish — and the five metrics that prove it is working.
Read article →Regex redaction misses most PII in real prompts and destroys the context the model needs. Deterministic tokenization with an encrypted, TTL-bounded vault satisfies both — plus what to log, what never to log, and why an unsalted hash is not anonymization.
Read article →Tell us about your estate and objectives — we respond within two business days with a scoped assessment and clear next steps.