Blog
Notes from the security team
What we are seeing in engagements, written for the people who have to act on it. No vendor pitch, no recycled threat statistics.
Understanding prompt injection: the 'holy grail' of LLM vulnerabilities
How prompt injection attacks work, why they top the OWASP list for LLM applications, and what actually reduces the risk in production systems.
Read article
The rise of AI-powered cyber attacks: what you need to know
Attackers adopted machine learning before most defenders did. Here is what has genuinely changed about the threat landscape, and what has not.
Read article
Zero trust architecture: a practical implementation guide
Zero trust is an architectural direction, not a product you buy. A staged approach that delivers value at each step rather than after a two-year programme.
Read article
VAPT essentials: vulnerability assessment versus penetration testing
The two are routinely sold as one service and confused in procurement. They answer different questions, and buying the wrong one is expensive.
Read article
Cloud security: the misconfigurations that cause real incidents
Cloud breaches rarely involve a provider vulnerability. They involve identity, storage, and network configuration — and the same handful of mistakes recur.
Read article
API security: where modern applications actually leak
APIs fail differently from web applications. Authorisation, not injection, is where the serious findings concentrate — and it is the hardest thing to automate.
Read article
Ransomware defence: the controls that actually change outcomes
Ransomware response is decided long before the ransom note appears. What separates a bad week from an existential event is preparation.
Read article