Prompt Injection Is an Authorisation Problem
Filtering malicious-looking text is a losing game. The durable fix is to constrain what an AI system is allowed to do, not to guess which input is hostile.
Insights
Notes from the work
Writing on the security problems we run into most often — AI systems, cloud estates, delivery pipelines and the programmes that hold them together. No vendor pitches.
Latest articles
Getting Service Account Keys Out of Google Cloud
Long-lived service account keys are the most common serious finding in a GCP assessment. A migration path to Workload Identity that will not break your pipelines.
Why Your Vulnerability Backlog Keeps Growing
A backlog that only grows is not a resourcing problem. It is usually a prioritisation model that treats every finding as equally real and equally urgent.
Follow along
New articles are published to the RSS feed as soon as they go live.
Discuss your security challenges
Tell us what you are trying to secure and where it hurts. We will tell you what we would do first, whether or not you engage us.