What belongs here
This section contains professional work on cybersecurity, FinTech, RegTech, AI and system architecture. Topics describe the subject; this lane describes the context of the work.
Ancveirs
Professional work
Deep technical and regulatory analysis, guides and case studies.
Context + topic
Professional articles
Cybersecurity
17 publicationsGuideCybersecurity
Bug Bounty & Crowdsourced Security: What a Good Programme Actually Optimises
A good bug bounty programme allocates researcher attention, rewards useful novel signal fairly and converts validated findings into measurable remediation.
GuideCybersecurity
Coordinated Vulnerability Disclosure in Practice: From Report to Verified Closure
A practical CVD lifecycle covering intake, acknowledgement, triage, reproduction, ownership, remediation, retest, disclosure and evidence-based closure.
GuideCybersecurity
CRA reporting: 24 hours, 72 hours and the risk of simplifying the law
A practical analysis of CRA Article 14 reporting: AEVs, severe incidents, 24/72-hour deadlines, final-report clocks, the SRP and common simplification errors.
AnalysisCybersecurity
CVD, Bug Bounty and Penetration Testing Are Not the Same Thing
CVD, VDPs, bug bounties, penetration tests and red teams differ in purpose, authority, scope, incentives, coverage and stop conditions. A practical European comparison.
AnalysisCybersecurity
Cybersecurity Certification Should Prove Effectiveness, Not Just Activity
Cybersecurity certification should prove scope, operating effectiveness, retesting and reassessment after material change—not merely that a control exists.
GuideCybersecurity
From Vulnerability Backlogs to Defensible Decisions: What Should Organisations Fix First?
A practical European approach to vulnerability prioritisation that keeps CVSS severity, EPSS forecasts, known exploitation and local asset context distinct.
AnalysisCybersecurity
Good-Faith Security Research in Europe: Where Is the Authorization Boundary?
Where does good-faith vulnerability research stop being permitted testing? NIS2, cybercrime law, CVD and a documented Latvian case study.
AnalysisCybersecurity
NIS2 and Vulnerability Researchers: Coordination Is Harmonised More Than Legal Protection
NIS2 requires national CVD coordination but does not create a universal researcher safe harbour. What Article 12, Recital 60 and national cybercrime law actually mean.
GuideCybersecurity
Proof Beats Prose: A Minimum Standard for AI-Assisted Vulnerability Reports
A practical evidence standard for AI-assisted vulnerability reports: scope, reproduction, PoC, demonstrated impact, severity, data minimisation and accountability.
GuideCybersecurity
Secure by Design Before Disclosure: What Organisations Must Do First
CVD and bug bounty cannot replace a secure SDLC. Use threat modelling, secure defaults, code and dependency controls, release gates and finding feedback.
GuideCybersecurity
Security Assurance Under Pressure: Pentest, Red Team, CVD, Bug Bounty and TLPT
Pentesting, red teaming, purple teaming, CVD, bug bounty and TLPT produce different evidence. Combine them deliberately into layered security assurance.
GuideCybersecurity
Security Evidence & Accountability: Who Actually Accepts the Risk?
A finding is not closed because a ticket says Done. Use risk ownership, residual risk, remediation evidence and verification to make decisions reconstructable.
AnalysisCybersecurity
Security Research in Critical Systems: Open Reporting Does Not Mean Open Testing
Critical systems need differentiated research models: public reporting, low-impact testing, registered researchers, vetted programmes and controlled testing.
AnalysisCybersecurity
The Ethical Hacker After Generative AI: Discovery Is Cheap, Accountability Is Not
Generative AI accelerates recon, hypotheses and reporting, while scope judgment, validation, impact analysis and accountable disclosure remain human responsibilities.
GuideCybersecurity
When a Digital Service Cannot Operate Normally: Designing a Safe Degraded Mode
A practical model for degraded digital-service operation: minimum service, dependency failure, manual fallback, reconciliation and controlled return to normal.
AnalysisCybersecurity
When Vulnerability Research Exposes Personal Data: Evidence, GDPR and the Point to Stop
What to do when vulnerability validation exposes personal data: researcher roles, lawful basis, minimum evidence, storage, reporting, deletion and breach boundaries.
AnalysisCybersecurity
Who Is Really Calling? Caller ID, Spoofing and Verifiable Fraud Signals
Caller ID is not identity proof. Separate number control, call-origin consistency and fraud risk without turning a “verified” label into a false safety promise.
FinTech & RegTech
5 publicationsAnalysisFinTech & RegTech
Anti-Fraud Network APIs in Europe: Why Common Syntax Is Not Enough
Anti-fraud network API interoperability needs more than a common schema: semantics, provenance, freshness, unknown states, privacy and clear legal-effect boundaries.
GuideFinTech & RegTech
CRA reporting: 24 hours, 72 hours and the risk of simplifying the law
A practical analysis of CRA Article 14 reporting: AEVs, severe incidents, 24/72-hour deadlines, final-report clocks, the SRP and common simplification errors.
GuideFinTech & RegTech
Data Sovereignty Is Not Data Location: Measuring Real Control Over Digital Infrastructure
A practical way to assess data sovereignty through identity, keys, control planes, logs, backups, supply chains, portability, recovery and tested provider exit.
GuideFinTech & RegTech
Security Assurance Under Pressure: Pentest, Red Team, CVD, Bug Bounty and TLPT
Pentesting, red teaming, purple teaming, CVD, bug bounty and TLPT produce different evidence. Combine them deliberately into layered security assurance.
AnalysisFinTech & RegTech
Who Is Really Calling? Caller ID, Spoofing and Verifiable Fraud Signals
Caller ID is not identity proof. Separate number control, call-origin consistency and fraud risk without turning a “verified” label into a false safety promise.
Responsible AI
4 publicationsAnalysisResponsible AI
AI Slop Is Not a Content Problem. It Is a Verification-Cost Problem.
Generative AI makes plausible claims, code and submissions cheap to produce. The deeper problem is what happens when verification still consumes scarce human time.
GuideResponsible AI
Proof Beats Prose: A Minimum Standard for AI-Assisted Vulnerability Reports
A practical evidence standard for AI-assisted vulnerability reports: scope, reproduction, PoC, demonstrated impact, severity, data minimisation and accountability.
AnalysisResponsible AI
The Ethical Hacker After Generative AI: Discovery Is Cheap, Accountability Is Not
Generative AI accelerates recon, hypotheses and reporting, while scope judgment, validation, impact analysis and accountable disclosure remain human responsibilities.
AnalysisResponsible AI
What Does an AI Benchmark Score Actually Prove?
How to interpret AI benchmark results without overclaiming: test scope, data provenance, language coverage, uncertainty, reproducibility and intended-use evidence.
Cloud & Architecture
3 publicationsGuideCloud & Architecture
Data Sovereignty Is Not Data Location: Measuring Real Control Over Digital Infrastructure
A practical way to assess data sovereignty through identity, keys, control planes, logs, backups, supply chains, portability, recovery and tested provider exit.
GuideCloud & Architecture
Secure by Design Before Disclosure: What Organisations Must Do First
CVD and bug bounty cannot replace a secure SDLC. Use threat modelling, secure defaults, code and dependency controls, release gates and finding feedback.
GuideCloud & Architecture
When a Digital Service Cannot Operate Normally: Designing a Safe Degraded Mode
A practical model for degraded digital-service operation: minimum service, dependency failure, manual fallback, reconciliation and controlled return to normal.
Digital Governance
9 publicationsAnalysisDigital Governance
AI Slop Is Not a Content Problem. It Is a Verification-Cost Problem.
Generative AI makes plausible claims, code and submissions cheap to produce. The deeper problem is what happens when verification still consumes scarce human time.
AnalysisDigital Governance
Anti-Fraud Network APIs in Europe: Why Common Syntax Is Not Enough
Anti-fraud network API interoperability needs more than a common schema: semantics, provenance, freshness, unknown states, privacy and clear legal-effect boundaries.
GuideDigital Governance
Data Sovereignty Is Not Data Location: Measuring Real Control Over Digital Infrastructure
A practical way to assess data sovereignty through identity, keys, control planes, logs, backups, supply chains, portability, recovery and tested provider exit.
AnalysisDigital Governance
Good-Faith Security Research in Europe: Where Is the Authorization Boundary?
Where does good-faith vulnerability research stop being permitted testing? NIS2, cybercrime law, CVD and a documented Latvian case study.
AnalysisDigital Governance
NIS2 and Vulnerability Researchers: Coordination Is Harmonised More Than Legal Protection
NIS2 requires national CVD coordination but does not create a universal researcher safe harbour. What Article 12, Recital 60 and national cybercrime law actually mean.
GuideDigital Governance
Security Evidence & Accountability: Who Actually Accepts the Risk?
A finding is not closed because a ticket says Done. Use risk ownership, residual risk, remediation evidence and verification to make decisions reconstructable.
AnalysisDigital Governance
Security Research in Critical Systems: Open Reporting Does Not Mean Open Testing
Critical systems need differentiated research models: public reporting, low-impact testing, registered researchers, vetted programmes and controlled testing.
GuideDigital Governance
When a Digital Service Cannot Operate Normally: Designing a Safe Degraded Mode
A practical model for degraded digital-service operation: minimum service, dependency failure, manual fallback, reconciliation and controlled return to normal.
AnalysisDigital Governance
When Vulnerability Research Exposes Personal Data: Evidence, GDPR and the Point to Stop
What to do when vulnerability validation exposes personal data: researcher roles, lawful basis, minimum evidence, storage, reporting, deletion and breach boundaries.