Compliance & Audits
Long-form
- The Assurance Model Was Built for a World That No Longer Exists
How periodic audit came to be, why its epistemic reach is shrinking, and what AI does to the mismatch.
- Why Continuous Assurance Did Not Happen Until Now
The economics of cognition, the limits of GRC software, and what AI actually changes.
- FIPS 140-3 Validation, in Practice
What the US and Canadian standard for validating cryptographic modules actually covers, with data from the validation corpus.