Insights
Practitioner perspectives on cyber risk, AI governance, data protection and GRC engineering.
22 October 2026
From 13 May 2027, the DPDP Rules expect security safeguards that work in practice, logs kept for a year, and a breach report to the Board within 72 hours. A policy cannot show any of that. This article explains why the answer is engineering, and how DPDP in Practice builds it on AWS, in public.
30 July 2026
Why peripheral platforms — the ITSM tools nobody classifies — have become the softest route to your most sensitive client data.
1 July 2026
Sixty-four percent of suppliers never disclosed new AI subprocessors. The annual vendor review has quietly stopped working.
23 June 2026
Article 73 of the EU AI Act gives high-risk providers as little as two days to report a serious incident — for a failure mode no SIEM was built to see.
9 June 2026
Consolidation does not reduce risk. It moves it, concentrates it, and turns sprawl you managed into a dependency you cannot unwind.
