Insights
Articles, research and the work behind them.
What KOR IT has written, and the systems the writing came out of. Where a claim is provisional, the page it sits on says so.
Articles
Positions reached while building.
What NIS2 and DORA actually ask of your telemetry
A 24-hour reporting clock is a data architecture requirement before it is a policy one. An engineering reading of what the EU incident-reporting regimes need from a security data platform.
September 2026 · 5 min read
Detection engineering is a software problem
Rule counts measure activity, not coverage. Treating detections as software — with dependencies, tests, owners and a retirement path — changes what a SOC can honestly claim.
September 2026 · 5 min read
The tiering decision: what a security data platform keeps hot
Security data architecture is mostly one recurring decision: which data is searchable in seconds, which is retrievable in minutes, and who is allowed to make the call.
September 2026 · 5 min read
Research
Questions the engineering ran into.
Memory Poisoning: When AI Agent Memory Becomes a Security Boundary
Persistent agent memory is an attack surface. We examine provenance, recall policy, and why memory operations remain largely invisible to the SOC.
Agent Security · September 2026
Memory Contract Specification
Experimental research, not a standard: can a runtime contract decide when a stored memory entry is permitted to influence an agent's reasoning?
Agent Security · June 2026
Agent Security: Identity, Tools, Memory and Runtime Policy
An active research programme on agent security: identity and authorisation, tool and MCP inventory, memory, runtime policy, and telemetry.
AI Security · April 2026
Projects
The systems behind the writing.
Agent Security Control Plane
Prototype control plane for governing how agents reach memory, tools, identities and data, with policy and telemetry as first-class layers.
AI Security · Agent Security
Memory Contract Specification
An experimental specification for runtime contracts that decide when a memory record is allowed to influence an agent. Principle: Trust Before Recall.
Agent Memory Security · Agent Security
Sovereign Agentic AI Lab
A self-hosted agentic AI environment on owned hardware, used to study inference, retrieval and agent security without external model dependencies.
AI Infrastructure · AI Security