Security · AI governance · Compliance

What experienced security people know, written down.

Tribal knowledge is what seasoned practitioners know but seldom document. This site shares it: practical guidance on AI security, governance and compliance, drawn from about 15 years inside regulated industries.

What you'll find here

• AI security and governance. Operating models, controls and evidence for AI systems, mapped to ISO/IEC 42001 and the NIST AI RMF.
• Threats, translated into controls. What a new vulnerability or incident means for your programme, checked against primary sources before anything is published.
• GRC that survives an audit. PCI DSS, SOC 2 and ISO 27001 explained through the evidence an auditor actually asks for.

How it's made

Every piece is researched with AI assistance, checked claim by claim against primary sources, and reviewed and edited by Kumar Mathialagan before it's published. Sources are always credited.

Start here

• B.R.I.D.G.E.: an open AI security operating model, with templates and worked examples.
• Insights: the latest articles.
• About the practice, and how to get in touch.

This site is new. Full articles and the frameworks library arrive in November 2026.