Each post covers one core concept. Read in order for the full picture, or jump to what is most relevant to where you are right now.
Post 01
The Model
What a model actually is, the 3 core attack paths, real incidents, security controls, and the 4 frameworks you need to know.
● Live now
Post 02
Training vs Inference
Two completely different attack surfaces. Understanding the difference changes how you think about AI risk entirely.
Coming soon
Post 03
Prompts are Inputs
Where prompt injection lives and why treating prompts as trusted input is one of the most dangerous mistakes in AI deployment.
Coming soon
Post 04
Context Windows
What the model sees at any given time and how attackers use that window against you.
Coming soon
Post 05
Embeddings & Vector Databases
How AI remembers things, how RAG pipelines work, and the retrieval-based attacks most teams are completely unprepared for.
Coming soon
Post 06
Agents & Tool Use
When AI can take actions, the blast radius explodes. The most important post in this series right now.
Coming soon
Post 07
Fine-tuning & RLHF
How models get customised and why the supply chain risk at the AI layer needs to be on every security team's radar.
Coming soon
Post 08
APIs as the Delivery Mechanism
Most enterprise AI is API-first. Classic API attack surface — now with an LLM sitting on top of it.
Coming soon