Blog
The Execution
The cybersecurity industry has spent decades and trillions of dollars building tools that operate after the fact.
Detect the breach. Respond to the incident. Recover the systems. Investigate the fraud.
Every one of those disciplines assumes the damage has already occurred and the goal is to limit it. Below, we examine what that assumption costs: real breaches, real losses, real organisations that did everything the industry told them to do and still lost. The question running through every post is the same: at the moment the consequential action executed, where was the human who should have stopped it?
What the Zero Trust for AI Agents Framework Gets Right and What It Leaves Unbuilt
Anthropic Wrote the Specification. GoFirm Is the Implementation
Read articleThe Intelligence Is There. The Authority Confirmation Isn’t.
Hybrid threats, decision points, and the gap between knowing and acting.
Read articleThe New Insider Threat Isn’t Human. It Isn’t Disgruntled. It Has No Motive at All.
AI agents are insider threats by default. The Wall Street Journal just put it on the front page.
Read articleThe US Treasury Was Breached Through Its Own Security Vendor.
The BeyondTrust Incident and the Unsolved Vendor Access Problem
Read articleThe Heist That Should Have Been Impossible
$81 Million. Valid Credentials. No Confirmed Authority.
Read articleThey Knew. It Happened Anyway. 2 Million Records Gone.
The Legal Aid Agency Breach and the Question Nobody Asked
Read articleAgentic AI is executing at machine speed. The authorisation boundary doesn’t exist yet.
The WEF Mapped the Problem. The Case Studies Prove It.
Read articleThe AI Asked for Authorization Evidence. The Attacker Bypassed It in 40 Minutes.
The Mexico breach didn’t fail because AI had no safety guardrails. It failed because authorization confirmation cannot live inside the model.
Read articleA Missing Checkbox. 190 Million Records. $2.9 Billion.
The Change Healthcare Breach and the Portal Nobody Protected
Read articleThe Board Is Asking the Wrong Question. Here Is the Right One.
Prevention versus resilience is the wrong frame. The right question is which scenarios cannot be recovered from once triggered.
Read articleBlog content generation is AI assisted.