Connor Wellbourne-WoodAI security, information security, and governance. CISSP, based near Zürich. I build the controls I write the policy for.https://madebyconnor.com/enEfficiency AI and opportunity AIhttps://madebyconnor.com/writing/efficiency-opportunity-ai/https://madebyconnor.com/writing/efficiency-opportunity-ai/There are two distinct reasons to bring AI into a business. Efficiency does the same work faster. Opportunity does work that was never feasible before. Rarely, one integration does both.Fri, 25 Sep 2026 00:00:00 GMTartificial-intelligenceenterprise-aidigital-transformationgenerative-aiPolicy velocity and the rate of control losshttps://madebyconnor.com/writing/policy-velocity/https://madebyconnor.com/writing/policy-velocity/We are governing AI at a fraction of the speed it is advancing. The gap between policy and reality compounds, and security and GRC practitioners are the ones who have to close it.Mon, 10 Aug 2026 00:00:00 GMTai-governancecybersecurityrisk-managementinfosecgrcTokenminninghttps://madebyconnor.com/writing/tokenminning/https://madebyconnor.com/writing/tokenminning/Enterprises are getting LLM bills larger than a developer's salary. Five ways to cut token cost without sacrificing output, starting with the biggest one, model routing.Mon, 06 Jul 2026 00:00:00 GMTllmopsagentic-aiai-engineeringcontext-engineeringgenerative-aiA night on Claude Code in regulated industrieshttps://madebyconnor.com/writing/claude-code-zurich/https://madebyconnor.com/writing/claude-code-zurich/A field note from Anthropic's Claude Code ZürichWed, 01 Jul 2026 00:00:00 GMTai-governancecybersecurityclaude-codeenterprise-aiHarvest now, analyse laterhttps://madebyconnor.com/writing/the-depth-of-data/https://madebyconnor.com/writing/the-depth-of-data/We assume we understand the value of data at the moment it is created. Wi-Fi became a sensor; a phone became a behavioural model. The signal barely changed. Our ability to read it did.Sun, 21 Jun 2026 00:00:00 GMTtechnologyaiinnovationcybersecurityprivacyControls that prove themselveshttps://madebyconnor.com/writing/compliance-as-code/https://madebyconnor.com/writing/compliance-as-code/Audit season exists because your controls can't speak for themselves. Compliance-as-code changes the question from "can you prove it" to "the proof is already in the repo".Mon, 15 Jun 2026 00:00:00 GMTcompliance-as-codegrcinfoseccybersecuritypolicy-as-codeAre LLMs a dead end on the path to AGI?https://madebyconnor.com/writing/llms-jepa-agi/https://madebyconnor.com/writing/llms-jepa-agi/LLMs predict the next token in a symbol soup. JEPA predicts in representation space, and can reason about consequences in a way an LLM cannot. Neither is there yet.Sun, 07 Jun 2026 00:00:00 GMTartificial-intelligencejepaagigenerative-aideep-learningSection: semantic DLP for the LLM erahttps://madebyconnor.com/writing/section-semantic-dlp/https://madebyconnor.com/writing/section-semantic-dlp/Your team is pasting customer lists into ChatGPT and leaking API keys into debug prompts. None of it is malicious, none of it is visible, and blocking the model is not a strategy. Open sourcing a proof of concept.Fri, 29 May 2026 00:00:00 GMTai-securityshadow-aidlpcisogrcopen-sourcellm-securityai-governanceThe Brain–AI–Brain sandwichhttps://madebyconnor.com/writing/brain-ai-brain-sandwich/https://madebyconnor.com/writing/brain-ai-brain-sandwich/Your AI workflows might be getting sharper, but your brain is getting softer. Invert the sandwich to Brain → AI → Brain, and protect the muscle that actually pays you.Sun, 24 May 2026 00:00:00 GMTaiartificial-intelligencechatgptfuture-of-workgenerative-aiThe EU compliance cliffhttps://madebyconnor.com/writing/eu-compliance-cliff/https://madebyconnor.com/writing/eu-compliance-cliff/Three 2026 deadlines define the rest of the year for anyone shipping AI into the EU. Treat the AI Act and the CRA as one engineering problem, not two compliance projects.Fri, 22 May 2026 00:00:00 GMTeu-ai-actcyber-resilience-actai-securityai-complianceai-governanceHarness engineering is the next frontierhttps://madebyconnor.com/writing/harness-engineering/https://madebyconnor.com/writing/harness-engineering/If the model is the engine, the harness is the entire vehicle. The same model can swing 20 to 40 points on a benchmark depending on its harness, and you're probably already building one without naming it.Fri, 08 May 2026 00:00:00 GMTai-engineeringllmopsai-evaluationagentic-aiai-safetyharness-engineeringAEGIS: prompt injection, solved outside the modelhttps://madebyconnor.com/writing/aegis-prompt-injection/https://madebyconnor.com/writing/aegis-prompt-injection/Every major AI lab now treats prompt injection as unfixable. AEGIS 1.0 is my counterargument, written in code. A model agnostic gateway that solves it with cryptographic provenance instead of natural language filtering.Sat, 02 May 2026 00:00:00 GMTprompt-injectionai-securityagentic-aimlsecopsopen-sourcegenaiYour next insider threat might not be a humanhttps://madebyconnor.com/writing/hidden-steganography/https://madebyconnor.com/writing/hidden-steganography/Two AI agents can appear fully compliant while signalling to each other through choices that look harmless in isolation. An insider threat model for hidden coordination between AI systems.Fri, 10 Apr 2026 00:00:00 GMTai-securityagentic-aicybersecurityai-architecturesecurity-researchai-riskCapability drifthttps://madebyconnor.com/writing/capability-drift/https://madebyconnor.com/writing/capability-drift/Authentication is no longer enough once agents can change their own power at runtime. An agent can be fully authenticated and still become unsafe minutes later.Tue, 07 Apr 2026 00:00:00 GMTai-securityagentic-aicybersecurityidentity-securityai-architecturezero-trust