Writing
Long-form analysis for board directors, executives, and the technology leaders who advise them. Updated regularly.
All writing
Technology Sovereignty
European technology sovereignty stopped being a policy debate in June 2026, when a U.S. export-control directive took two frontier AI models dark worldwide for nineteen days. The five dependency layers, and a practitioner's roadmap to 2035.
AI Governance
The AI-agent readiness checklist describes deterministic automation, not AI. Why a bounded agent produces the data inventory no assessment can, and what has to be true before it runs.
AI Governance
Seventy percent of an AI program is people. Most governance diagrams give them one box.
Cyber Governance
The metrics that matter when the control is the exposure. Why the board dashboard of the last decade is finished, and the six numbers that replace it.
In 2019 I asked how organizations should be penalized for breaches they could have prevented. The same question now applies to AI failures, in a regulatory environment that finally has teeth.
AI Economics
More compute doesn't win the AI race. A dotcom veteran on the spending fallacy behind the AI bubble — and the one question boards should be asking.
In 2018 I predicted the SEC would require public companies to disclose cyber risk. The rule landed in 2023 — five years later than I thought. Here's what the structural calls got right, the timing calls got wrong, and three predictions for AI governance in the next 24 months.
AI Strategy
A board-level map of the US, EU, and Chinese AI model vendors over the next 18 months: each bloc's strategic bet, and the governance exposure your enterprise inherits with each choice.
A 2017 analysis of cyber risk in 10-K filings — TJX, Target, Home Depot — combined with what changed under the SEC's 2023 cyber disclosure rule and a forecast of AI-specific 10-K disclosure within the next 18-24 months.
AI Governance
Boards spent 20 years building software supply chain controls. AI just opened a new one — and it now has CVE numbers. Here's what's missing.
A 2016 essay on what it actually feels like to be on the receiving end of a breach notification call — reissued with a 2026 preface that maps the same dynamic onto the first generation of serious AI failures.
AI Security
Anthropic’s Mythos preview found ten thousand critical vulnerabilities in a month. None of them are how your enterprise gets breached this quarter. Here is what is.
Eight years on from GDPR, the EU AI Act is doing for AI what GDPR did for data. Here's what the second-order effects looked like then — and what to plan for now, with 65 days to go.
AI Governance
Why boards are approving AI layoffs against a 24% capability ceiling — and what governance discipline actually looks like before you cut.
A 2016 piece about why information security is the responsibility of everyone in the organization — reissued with a 2026 preface that applies the same argument, almost word for word, to AI governance.
AI Architecture
Why the future of AI won't be decided by the biggest model — and the five architectural decisions every enterprise is already making, whether they realize it or not.
Enterprise AI
Why 87% of customer-facing leaders agree, only 5% deliver — and what the next 14 weeks will reveal about who's prepared.
Editorial
Why this site, and why now. A note on what to expect from the writing here, and the framework behind it.
Board Governance
A practical guide for directors who want to lead, not just comply.