Blog
Thoughts on technology, infrastructure, and AI from 25+ years in the field.
Agent workflows take actions, not just text. What UK SMEs should log for every run — and who should be checking it — before an audit or renewal.
Fractional CISO or virtual CISO? In the UK market the terms overlap heavily. What actually differs, what each costs, and how to choose for your SME.
A security threat model for Hermes Agent moving into enterprise networks: prompt injection, self-written skills, chat takeover, and practical controls.
This week’s GitHub activity focused on inventory accuracy, safer automation boundaries, and turning new pilots into operationally credible systems.
A Gemini agent caught hacking, governments demanding human control, and platforms blocking rival agents all point one way: governance is now operational.
This week’s GitHub activity centred on operational clarity, safer automation, and the early scaffolding for new project work.
A weekly update on how recent GitHub activity clustered around security hardening, governance, roadmap clarity, and shipping website work.
A weekly update on routing, security, design cleanup, and the operational discipline that makes AI systems easier to trust.
A practical weekly update on making automation and AI systems easier to trust by reducing guesswork in routing, monitoring, and delivery.
Recent GitHub work shows why upgrades, failure handling, and handover notes are now leadership concerns for AI, automation, and client systems.
Serious AI pilots need a rehearsal environment with realistic data, clear gates, fallback paths, and review controls before they touch live operations.
If you want an AI assessment or advisory funnel to win trust with serious buyers, the operating model has to be designed before the launch page goes live.
A useful AI stack is not a list of fashionable components. It is a system with clear roles, observable behaviour, and rules that make the parts work together.
What production hardening really means for a leadership team: catching committed secrets, scoring security maturity, and the questions to ask any supplier.
AI agents no longer answer questions — they take actions on your systems. Without audit trails, you cannot reconstruct what happened or prove compliance.
AI agents are moving from demos to production work. Organisations getting real value treat them like a production team, not a single chat window.
Technology debt rarely kills a transaction outright. More often it weakens confidence and makes management look less prepared than it should.
Microsoft 365 is the backbone of most UK businesses, but the default tenant configuration isn't secure enough for a regulated organisation.
Connecting AI agents to business systems without a control plane is like a data centre with no monitoring — nobody knows what broke until it's too late.
AI pilots are accelerating across UK SMEs. Without senior security leadership before they scale, organisations risk exposure that's far cheaper to fix upfront.
A Fractional IT Director gives a growing business senior technology leadership without the cost or timing risk of a full-time hire, with real accountability.
The biggest AI lesson was not about prompting. Decades of infrastructure, security, and delivery experience became more valuable once the pace increased.
The multi-agent framework wave (CrewAI included) solved coordination but raised new risk — minimum access, logging, and injection testing explained.
How explicit budgets, mandatory human review points, and scheduled batch runs stopped one AI workflow sprawling — with real before-and-after figures.
AI governance is best understood as an extension of the zero-trust assumptions that already apply in security architecture, not a separate discipline.
Before enabling M365 Copilot, audit SharePoint, Teams, and guest access: it surfaces whatever permission sprawl already exists in your tenant.
Why I shifted AI experiments from cloud APIs to a home lab: workload trade-offs, rough cost framing, and the data-boundary questions SMEs should ask.