Practical, long-form writing on IT infrastructure, project delivery and cyber security.
HashiCorp has put a KMS v2 plugin for Kubernetes into public beta, moving the key encryption key that protects etcd out of the cluster and into Vault Enterprise. It closes a real gap for self-managed clusters — but it fixes a narrower threat than most people will assume, and it couples your API server availability to Vault in ways worth rehearsing before production.
Microsoft has moved the Copilot conversation from seats sold to work transformed — a sensible shift, and a harder one than the phrase suggests. Here's what the seat number actually tells you, what it doesn't, and what I'd instrument before the renewal conversation arrives.
An InfoQ talk on building resilient infrastructure platforms lands on familiar ground — technical debt, deprecation, engineering culture. They are the three themes most organisations consistently underfund. Here's what they look like from the delivery end, and why deprecation is the one nobody budgets for.
An InfoQ Live panel on production operations in the age of AI circles a question most of us have been avoiding: our incident-response discipline assumes the same input produces the same output. Once a model sits in the request path, that assumption is gone — and the runbook, the regression test and the RCA template go with it.
Microsoft has put a dedicated AI Gateway tier of Azure API Management into public preview, with a control plane built around models, MCP servers and tools rather than APIs. The consolidation is genuinely useful. The governance claim needs testing, because a gateway only governs the traffic that agrees to go through it — and MCP tools are not APIs in any sense your existing policy set understands.
Midnight Blizzard's Storm-2945 sub-cluster has been manipulating traffic on hotel and venue captive portal networks since May 2026 to push malware and harvest credentials from travellers. The technique is unremarkable. What matters is that captive portals sit in a blind spot most of us built deliberately — and the fix is policy and device posture, not another detection rule.
Microsoft says Defender isolated a compromised QNET endpoint in 128 seconds and stopped a ransomware chain before it spread. The number is real enough — but it's the end of a long configuration story, not the start of one. Here's what has to be true in your tenant before automatic disruption can act that fast, and why most tenants wouldn't have got there.
A credential-stealing worm that republishes itself through npm packages isn't news because worms are new — it's news because it proves the build pipeline is now the highest-value unmonitored identity in most estates. Here's what I'd actually go and check.
Microsoft has been named a Leader in a brand-new Gartner Magic Quadrant for AI-augmented code modernisation tools. The analyst placement is marketing; the underlying category is real. Here's what actually determines whether an AI-assisted modernisation of your legacy estate succeeds — and it isn't the tooling.
Stripe modelled its global database estate as a graph and let graph search plus state machines compute the recovery plan. The interesting part isn't the algorithm — it's the prerequisite. Most of us can't automate remediation because we can't describe our own estate accurately enough for a machine to reason over it.
A guilty plea closes the legal chapter on the 2024 Snowflake extortions, but the control failures behind it are still sitting in most estates: long-lived static credentials in a data platform, MFA left as an optional per-user setting, no network policy, and no alerting on bulk egress. Here's what I'd check this quarter.
GCC is restrictive, the kernel is pragmatic, the Kubernetes world runs on disclosure. That fragmentation isn't a governance failure — it's a signal that provenance is now a per-project property of every dependency you ship, and your one-page AI policy doesn't survive contact with it.
Canva rebuilt session revocation for hundreds of millions of active sessions using S3 for durability and compact in-memory indexes at the gateways. You will never build this — but the design exposes the question most IT estates cannot answer: how long after you click 'disable' is the user actually out?
Microsoft is folding SIEM and threat protection together under an agentic banner in Defender. The interesting question isn't whether the agents are clever — it's whether your estate has the identity hygiene, log coverage and response discipline to let anything act on your behalf.
Microsoft's FORGE Lab is pushing AI-assisted vulnerability research from Windows into the Linux kernel. The direction of travel is clear: the operational lesson has almost nothing to do with how clever the finding is, and everything to do with how slowly most estates absorb a fix.
Microsoft shipped fixes for 418 vulnerabilities this month, 62 of them critical. Only one is being exploited in the wild. That ratio — not the headline count — is the thing your change process has to survive, and most can't. Here's the triage order I'd actually use, and why QUIC and the DNS Server role deserve to jump the queue.
Microsoft Threat Intelligence has published an analysis of DeadLock, a Rust-based ransomware operation running its victim communications and leak sites on decentralised infrastructure. The encryptor is unremarkable. The infrastructure model is the story — and it quietly weakens one of the few reliable wins defenders and law enforcement had left.
Apple's latest round of updates carries a security fix only for the older branches — iOS 26, macOS 26 and macOS 15 — against a flaw already being exploited. The current branch isn't affected. That inversion of the usual pattern has a few uncomfortable implications for anyone running a deferred-update fleet.
Microsoft reports that Star Blizzard has refined its phishing and malware delivery with a technique it tracks as RedFlick, leaning on compromised legitimate websites. The operational lesson is plain: if your detection strategy depends on domain reputation, a well-chosen compromised host walks straight past it.
Russia's most capable intrusion teams have reportedly picked up ClickFix — the fake-CAPTCHA, paste-this-into-Run trick that until now belonged to commodity crimeware. The technique hasn't changed. What's changed is who's holding it, and that should reorder a few of your assumptions about what 'sophisticated' looks like.
For a year Copilot was something end-users asked me to turn on. In 2026 it quietly became something I have to administer — with an identity, a place in the org chart, and access to everything the person running it can reach. Here's what that means for the people who keep the estate running.
I've run IT projects in Kuwait, Malaysia and India — a telecom cell-expansion here, a national metering program there, a holding-company migration somewhere in between. The certifications gave me the vocabulary. The border crossings taught me everything the vocabulary leaves out.
Attackers got an AI. So did the defenders. Microsoft Security Copilot triages phishing hundreds of times faster than a human analyst — which is genuinely useful and quietly dangerous, in ways worth being precise about. Notes from the AI-vs-AI front line.
People see the alphabet after my name — PMP, CISM, TOGAF, CCNP, CISA, CEH — and assume I collect certificates. The truth is more useful: each one marked the moment a new layer of the technology world stopped being someone else's problem. Here's the map, honestly drawn.
On 2 August, the EU AI Act's obligations for high-risk systems become enforceable, with penalties that reach into the tens of millions. Most organisations aren't ready, and most already have more AI in the building than they think. Here's how I'd govern it, from the auditor's chair.
The agentic project-management pitch is seductive: AI spots the slipping dependency, drafts the update, chases the action item. Having actually used it across real delivery, here's my honest split — what it takes off your plate, what it quietly can't do, and the skill that decides whether it helps you or misleads you.
I got the plan-driven certifications first and the agile ones second, which is backwards from how the internet tells you to do it. It turned out to be the right order for the organisations I actually work in — conservative, governed, allergic to the word "sprint". This is how I make iteration land anyway.
I hold PMP, PRINCE2, PMI-ACP and CSM — so I get asked weekly which one to pursue. The honest answer is a decision tree, not a favourite. Here it is, with the trade-offs the training providers won't lead with.
Most IT jobs are archaeology — you inherit someone else's decisions and spend years excavating them. Occasionally you get a blank sheet: a new venue, no legacy, design it right. This is how I built one on Azure, and the order of operations I'd defend to anyone.
People assume Microsoft 365 arrives secure. It arrives functional, which is not the same thing. Here is the exact baseline I stand up before I let a tenant carry real work — the fundamentals that stop the incidents I actually see.
Hold one ISACA certification and you have a specialism. Hold all three and something better happens: you can walk a finding from the server room to the boardroom without it changing shape on the way. Here's how the triangle fits together.
I learned to break into systems before I learned to audit them. Reversing that instinct — from "how would I attack this?" to "could I prove this control works to a sceptic?" — did more for how I actually run IT than any tool ever did. Here's the shift, and why it matters more in 2026 than it did when I sat the exam.
A younger engineer asked me last month whether CCNP is a waste of time now that networking is "just SASE in the cloud". It's a fair question with a longer answer than he wanted. The fundamentals didn't die. They moved — and knowing where they moved is exactly what separates an operator from a button-pusher.
CEH gets dismissed by pentesters and over-sold by training ads — both miss its actual job. Paired with CHFI, it teaches the two halves of a defender's imagination: how systems get broken into, and how the truth gets reconstructed afterwards.
Every few years someone declares enterprise architecture dead — usually while their organisation buys its third overlapping platform of the quarter. I'm TOGAF-certified, I've seen the framework abused, and I still think its core discipline has never been more necessary than right now.
Passwords are the only technology we all agree is broken yet all keep using. Passkeys are the first replacement with a real chance — because they're easier than what they replace, not just safer. Here's how they work and how to ship them.
Say 'change advisory board' near a DevOps team and watch the eye-rolls. Say 'who owns this service?' during a sev-1 and watch everyone reach for ITIL vocabulary without knowing it. The framework's ideas outlived its bureaucracy — here's what to keep.
Ten years of watching ransomware go from a nuisance to an existential business risk — WannaCry, NotPetya, Colonial Pipeline, the leak-site era — and what each turning point taught the people who actually defend estates.
Equifax, SolarWinds, Log4Shell, MOVEit — the breaches that changed how every IT leader has to think about risk. How the threat moved from your own walls to your suppliers' walls, from an auditor's chair.
A decade of running the Microsoft stack — on-prem Exchange and Active Directory, the Office 365 migration, the certification earthquake of 2018–2021, identity as the new perimeter, and now Copilot. What churned, and what compounded.
Ten years of delivery — the methodology wars, the scaling experiments, the remote-work shock of 2020, PMI's own pivot to agile and hybrid, and ITIL 4. How the industry stopped fighting about method and settled on hybrid.
A decade rewrote the certification landscape — Microsoft's role-based pivot and the MCSE retirement, Cisco's 2020 consolidation, the 2021 PMP overhaul, ITIL 4, and the rise of verifiable digital badges. What it means for building a stack now.
Ten years that turned networking inside out — MPLS and on-prem firewalls giving way to SD-WAN, the cloud dissolving the perimeter, and zero trust and SASE becoming the model. What changed, and why the fundamentals only got more valuable.