AI is not just another tool in the cybersecurity stack. It is becoming part of the system being defended, part of the system doing the defending, and increasingly part of the system being attacked. This piece separates cybersecurity with AI, models that detect threats, triage alerts, and accelerate response, from cybersecurity of AI, where the model itself, its data, prompts, outputs, permissions, and training pipeline become the attack surface. It walks through adversarial manipulation, poisoned training data, inference and privacy leaks, and the model as a weapon, then argues for governance without theatre: discipline across the whole chain rather than one framework or control. As models move from tool to participant, the old security boundary does not disappear, part of it moves inside the model.
Writing
Essays, papers, notes, and references.
A place for longer pieces, formal work, and useful written records.
AI is not just another tool in the cybersecurity stack. It is becoming part of the system being defended, part of the system doing the defending, and increasingly part of the system being attacked. This piece separates cybersecurity with AI, models that detect threats, triage alerts, and accelerate response, from cybersecurity of AI, where the model itself, its data, prompts, outputs, permissions, and training pipeline become the attack surface. It walks through adversarial manipulation, poisoned training data, inference and privacy leaks, and the model as a weapon, then argues for governance without theatre: discipline across the whole chain rather than one framework or control. As models move from tool to participant, the old security boundary does not disappear, part of it moves inside the model.
“IoT” hides a fault line. Consumer IoT, smart homes, wearables, connected cars, optimises for convenience. Industrial IoT optimises for efficiency, safety, and uptime, running factories, energy grids, and healthcare where a failure is not an inconvenience but a danger to life. They share the name and almost nothing else: devices, networks, security models, scalability, and regulatory weight all diverge sharply. This piece draws the line clearly, comparing the two across purpose, hardware, security risk, data complexity, networking, and cost, and argues that conflating them leads to bad decisions in both directions: consumer-grade thinking applied to industrial systems that can hurt people, and industrial caution wasted on a doorbell. Whether you are smartening a home or securing a plant, the first move is knowing which world you are in.