The Oracle Cloud breach didn’t just expose 140,000 tenants, it revealed the silent danger of transitive trust across SaaS ecosystems. This post analyses the breach, outlines what could’ve been done, and offers a practical response guide for engineering and security teams. Featuring tools, trust graphs, and lessons for the road ahead.
The AI-driven SaaS boom, powered by code generation, agentic workflows and rapid orchestration layers, is producing 5-person teams with £10M+ in ARR. This breakneck scale and productivity is impressive, but it’s also hiding a dangerous truth: many of these startups are operating without a secure software supply chain. In most cases, these teams either lack … Read more
Trump’s latest Executive Order 14144 marks a strategic pivot in U.S. cybersecurity policy—narrowing sanctions, revoking digital ID initiatives, and mandating standards for AI and software security. In this first part of a two-part analysis, I unpack the deeper shifts beneath the headlines and highlight what practitioners, policymakers, and tech leaders need to watch.
We built and launched a PCI-DSS aligned, co-branded credit card platform in under 100 days. Product velocity wasn’t our problem — compliance was. What slowed us wasn’t the tech stack. It was the context switch. Engineers losing hours stitching Jira tickets to Confluence tables to AWS configs. Screenshots instead of code. Slack threads instead of … Read more
Introduction The AI industry’s safety narrative has been shattered. HiddenLayer’s recent discovery of Policy Puppetry — a universal prompt injection technique — compromises every major Large Language Model (LLM) today, including ChatGPT-4o, Gemini 2.5, Claude 3.7, and Llama 4. Unlike traditional jailbreaks that demand model-specific engineering, Policy Puppetry exploits a deeper flaw: the way LLMs … Read more
The Myth of a Single Cyber Superpower: Why Global Infosec Can’t Rely on One Nation’s Database What the collapse of MITRE’s CVE funding reveals about fragility, sovereignty, and the silent geopolitics of vulnerability management I. The Day the Coordination Engine Stalled On April 16, 2025, MITRE’s CVE program—arguably the most critical coordination layer in global … Read more
A strange sense of déjà vu is sweeping through the cybersecurity community. A threat actor claims to have breached Oracle Cloud’s federated SSO infrastructure, making off with over 6 million records. Oracle, in response, says in no uncertain terms: nothing happened. No breach. No lost data. No story. But is that the end of it? … Read more
U.S. Cyber Warfare Strategy Reassessed: The Risks of Ending Offensive Operations Against Russia Introduction: A Cybersecurity Gamble or a Diplomatic Reset? Imagine a world where cyber warfare is not just the premise of a Bond movie or an episode of Mission Impossible, but a tangible and strategic tool in global power struggles. For the past … Read more
Introduction: A Fractured Future for AI? Imagine a future where AI development is dictated by national interests rather than ethical, equitable, and secure principles. Countries scramble to outpace each other in an AI arms race, with no unified regulations to prevent AI-powered cyber warfare, misinformation, or economic manipulation. This is not a distant dystopia—it is … Read more
Why Ending the CSRB Puts America at Risk Imagine dismantling your fire department just because you haven’t had a major fire recently. That’s effectively what the Trump administration has done by disbanding the Cyber Safety Review Board (CSRB), a critical entity within the Cybersecurity and Infrastructure Security Agency (CISA). In an era of escalating cyber … Read more