What The VLAN?! My ASUS Router Has Been Keeping Secrets An ASUS ZenWiFi XT9 Mesh, a Raspberry Pi, two guest VLANs and no new networking hardware. What could possibly go wrong? Sometimes security research begins with a vulnerability. Sometimes it begins with a design problem. This time it began with …

A few days ago, I published High Confidence Is Not a Security Control, having spent some time looking at JEV, a specialised decision model, and the security implications of allowing probabilistic AI judgments to drive consequential actions. The concern was straightforward: a model receives evidence, …

AI security tooling keeps getting faster. Faster triage, faster classification, faster threat intelligence analysis, faster decisions. And, increasingly, faster automated action. That’s exciting, but it’s also where things start getting dangerous. I’ve been looking at JEV recently, …

This is a personal blog. All opinions are my own - not my employer’s. There’s apparently a new category of security incident called AI escape. Except there isn’t. That phrase might be useful shorthand for headlines, and some of the incidents behind it are genuinely serious, but I think …

We keep acting like doors are portals into trust and expected good behaviour. That was never true, but has never been more dangerous an assumption than it is now.

The next generation of supply chain attacks aren’t targeting packages. They’re targeting repositories. The June 2026 Azure Functions incident may be a glimpse into what that future looks like.