Does blocking AI work?
Not for long. A block moves AI use to places you cannot see. Allowing approved tools and explaining each stop works better.
Blog
Notes on data and AI security
Practical articles on data, AI and audits.
Keep the keys out of the prompt
The risk in a coding prompt is rarely the algorithm. It is what rides along: keys, connection strings and customer data in fixtures.
Corporate account or personal account?
Same AI service, two very different risks. A policy that only looks at the domain cannot tell them apart.
What the agent does off the network
A policy that only works in the office is a suggestion. Here is what should happen when a laptop has no connection at all.
PCI DSS 4.0.1 and data in motion
Two PCI DSS requirements are data loss problems in disguise. Both assume you can find card data and control how it moves.
Evidence an auditor can trust
When an auditor asks what happened, "we think" is not an answer. A useful record explains itself and cannot be quietly changed.