Attomus

Somewhere in nearly every security product’s marketing sits the phrase “military-grade encryption”. Pause on what that phrase actually tells you. The honest answer is: that the vendor employs a marketing department. There is no military grade. The world’s militaries use, for the most part, the same published algorithms as everyone else – AES is approved for US classified info...

A growing share of the traffic arriving at any organisation’s website is no longer human. Some of it is the familiar crawling of search engines. But an increasing fraction is something newer: AI agents acting on behalf of specific people – researching a purchase, evaluating a supplier, summarising a market, shortlisting firms for a piece of professional work. The recommendati...

“Military-grade encryption.” “Zero-knowledge architecture.” “Bank-level security.” “Secure enclave protection.”

These phrases appear all over the App Store listings for security products, and most of them are meaningless, misleading, or too vague to be useful. The damage they do reaches well beyond the individual product that deploys them. The argument here is not that...

Every organisation runs on software it did not write, built by people it has never met, assembled from components those people did not write either. The traditional governance answer to this uncomfortable arrangement is the supplier-assurance process: questionnaires, certifications, contractual flow-downs, and an annual review. Anyone who has sat on either side of it knows wh...

Threat modelling has a reputation problem. Ask a developer what a threat model is and you tend to get one of two answers. The first: an architectural diagram with threat labels, produced during design and never looked at again. The second: the section of a compliance document everyone writes carefully and nobody reads, including the people who wrote it.

Both of those e...