Insights
Short pieces from the editors: notes on what we read, commentary on what moved, and practice notes on what has held up. Opinions are ours; facts carry their source.
9 of 9
An article reading China's AI guidance for banks and insurers puts the grading line at whether a security system can act, not at whether it touches money.
AI7 Sept 20264 min read
The prohibited-practice list reads as a product problem. A security function's own tooling touches three of its points, and two more start in December.
AI6 Sept 20265 min read
Three articles in one issue argue that the supply chain is now four chains. The bill of materials that stops at code no longer describes what ships.
Security practice6 Sept 20264 min read
An Australian government report moves the governance object from the single agent to the relationship between them. The stop-point sits where control ends.
AI6 Sept 20264 min read
Singapore's advisory on the OpenClaw agent platform moves AI risk from what a model says to what an agent can do. The controls it lists are identity controls.
AI5 Sept 20263 min read
An agent reaches production on its installer's identity, holding every tool that person held. This is the review that should have run first.
AI5 Sept 20265 min read
Article 14 starts in September 2026 and the essential requirements in December 2027. The first quarter is three decisions, not a compliance programme.
Regulation and audit5 Sept 20265 min read
A Chinese-language piece argues that open-source risk lives in maintainers and funding, not in CVE queues. We agree, and add the control it implies.
Security practice5 Sept 20263 min read
A vendor piece uses Anthropic's Mythos findings to argue that boards should hear attack paths and expected loss, not patch rates. Half of it holds.
Security practice5 Sept 20263 min read