Everything we have published so far
Answers, definitions and the regulations, each one written out in full rather than summarised
The problem
What shadow AI is, how data actually leaves, and what it costs when it does.
- Glossary Shadow AI Employee use of AI outside governed channels: personal accounts, unapproved products, and the browser tab nobody logged. 3 min read
- Discovery Finding shadow AI Four ways to find out which AI tools your staff actually use, what each one misses, and why the survey is the least reliable of them. 7 min read
- The answer Does ChatGPT train on pasted company data? What the enterprise agreement actually says, and the five risks that survive a no-training clause. 6 min read
- Copilot Microsoft Copilot data security Copilot inside your tenant is a permissions problem. Copilot in a browser tab on a personal account is a different problem entirely. 6 min read
- The business case What an AI data leak costs The numbers that stand up in a budget conversation, where they come from, and the two costs that never appear in the breach studies. 6 min read
The category
What AI DLP is, how it differs from the controls you already own, and how to judge one.
- Glossary AI DLP Data loss prevention applied to the prompt layer, and why files, email and network traffic are the wrong place to look. 4 min read
- The comparison AI DLP vs CASB vs endpoint DLP What a CASB, endpoint DLP and a web gateway each inspect, and the surface that falls between all three. 6 min read
- Evaluation How to evaluate an AI DLP tool The questions that separate these products, starting with the one most datasheets avoid: where does classification actually execute. 6 min read
- Build or buy Build or buy AI DLP The prototype is a weekend. The parts that take years are context, surface coverage, enforcement that does not break the tools, and the evidence trail. 6 min read
- Glossary Coverage gap A surface a control does not inspect. The dangerous ones are silent: indistinguishable from a surface with nothing on it. 3 min read
- Glossary On-device redaction Masking the value where it is found, so the unredacted one never enters a log, a queue or a vendor's system. 3 min read
- The architecture DLP without reading employee messages How a control can stop a send without a transcript ever existing. 6 min read
Compliance
What each regulation actually requires when a prompt carries regulated data.
- HIPAA No AI tool is HIPAA compliant on its own Compliance depends on a BAA and on how you use the tool. What counts as PHI in a prompt, and what a disclosure is. 6 min read
- GDPR GDPR and AI tools: two problems, not one Pasting personal data into an AI tool is a processing and transfer question. Monitoring for it is its own processing. 6 min read
- PCI DSS What happens when a PAN reaches a chatbot Pasting a primary account number into an AI tool puts card data in an unassessed system. What PCI DSS requires of you. 6 min read
- EU AI Act The EU AI Act and AI tools Most staff use of ChatGPT is not high-risk under the Act. The obligations that do apply are literacy, disclosure, and the GDPR duties underneath. 6 min read
- SOC 2 SOC 2 and AI tools AI tools are a vendor question and a confidentiality question at once. What an auditor asks, and which controls the answers sit under. 6 min read
- The law Is monitoring employee AI use legal? Notice, works councils and jurisdiction: what we know, and what needs your counsel. 6 min read
Putting it in place
Policies, rollout, and the decisions made before any of it is switched on.
- Policy Writing an AI acceptable use policy The clauses that matter, the ones that get ignored, and why a policy written before you know your own usage is a guess. 6 min read
- Prevention How to stop employees pasting sensitive data into ChatGPT Blocking, training, an AI gateway, endpoint detection, and the failure mode of each. 6 min read
- Glossary Sanctioned AI tool A tool approved under contract with agreed data handling terms, and why that approval attaches to the account rather than to the website. 3 min read