NYDFS Part 500 Final Phase Is Live: The Asset Inventory and MFA Duties You Must Now Evidence
The final NYDFS Part 500 tranche made a maintained asset inventory and expanded MFA mandatory on 1 November 2025. Here is how to build and evidence both.
Pillar: Pillar 01 - Asset & Estate Visibility
Pillar 01 · See
Automated Cryptographic Inventory: Generating a CBOM From Your Estate
You cannot migrate cryptography you cannot see. A hands-on build for automating discovery of algorithms, keys and certificates into a CycloneDX CBOM that stays current.
The AI System Inventory Schema That Maps to the AI Act Risk Tiers
An AI inventory only earns its keep when each record maps to a risk tier and carries the fields the EU AI Act obliges you to produce. Here is the schema, designed backwards from the obligations.
How to Audit a Technology Estate You’ve Never Seen Before
Walking into an organisation on day one and being asked “so, how are we doing” is the single most common moment in fractional CTO work, and it’s also the moment where a wrong first move costs months. There’s no existing context, no institutional memory of past decisions, and a genuine risk of either taking too …
AI-Accelerated Shadow IT: When Non-Coders Build Ungoverned Agentic Workflows
Shadow IT used to mean a marketing team quietly signing up for an unapproved SaaS tool. It now means a non-technical employee, using a low-code agent builder, quietly wiring together a workflow that reads customer data, calls an external API, and takes automated action — with no code review, no security review, and no one …
Technology Due Diligence in the Agent Era: New Questions for the Data Room
The technology due-diligence checklist most acquirers still use was written for a world of static software estates. It asks about the codebase, the infrastructure, the technical debt. It does not ask, in most current versions I’ve seen, what AI agents the target company runs, what those agents can actually do, and what happens to that …
What to Do With the System Nobody Understands Anymore
Every organisation of any age has one: a system, usually critical, that nobody currently on staff fully understands. It works, mostly, and everyone is afraid to touch it — which is a completely rational fear, and also a slowly compounding risk that doesn’t resolve itself by being left alone. I’ve written about knowledge concentration as …
Hiring Your First Engineer: What to Look For
A founder hiring their first engineer is making a decision they’re structurally unqualified to evaluate on the dimension that matters most — technical judgment — while under real pressure to get it right, because the first engineer disproportionately shapes every engineering decision that follows. Most hiring guidance for this specific moment either assumes technical fluency …
Starlink at Sea: How Connectivity Ended the Isolation That Protected Ships
A vessel’s isolation used to be its own cyber defence — weeks at sea with no meaningful connectivity meant no meaningful remote attack surface, whatever the ship’s onboard systems actually looked like underneath. Low-earth-orbit satellite connectivity has quietly ended that protection for a huge share of the global fleet, and a great deal of maritime …
Supply Chain Risk: The Dependencies You Didn’t Choose
Every organisation carefully vets its direct vendors. Almost none of them look one layer further, at the dependencies those direct vendors themselves rely on — the sub-processors, the open-source libraries, the fourth-party infrastructure providers nobody at the organisation ever chose, evaluated, or even knew existed until something went wrong three layers removed from anyone’s actual …