Latest edition
Blog · 267 analyses
Context for better decisions.
Analysis on AI, cybersecurity, regulation, governance and digital systems. With sources, practical consequences and one clear next action.
All analyses
241–252 of 267
Current knowledge, organised by topic, date and practical consequence.
A timeout does not reveal whether the server failed before or after the effect. Safely retrying POST or PATCH requires operation identity, request fingerprint, execution state, a retained result, and an expiry policy.
Read analysis
Cache-Control is not one recipe. Versioned public content, anonymous HTML, personalised responses, authenticated data, and temporary errors need different policies and keys — verified in browser, CDN, and origin.
Read analysis
The AI Office is developing independence and qualification requirements for external evaluators of general-purpose models with systemic risk. Even outside that perimeter, buyers need to distinguish reproducible testing from a commercial seal.
Read analysis
NIST and OWASP treat prompt injection as an attack class that can arrive through direct requests or external content. In systems with retrieval and tools, asking the model to ignore malicious instructions is not a security boundary.
Read analysis
From 12 January 2027, in-scope providers may not charge customers for the switching process. That does not make applications portable by magic: contracts, formats, interfaces, dependencies, and tests must be ready before an exit request.
Read analysis
The final June revision brings security, privacy, and cybersecurity supply-chain risk plans together as system plans. Its value is not three long documents; it is consistent facts that follow the lifecycle.
Read analysis
The NIST IR 8286 series connects cyber risk to enterprise risk, while SP 1308 links risk, CSF profiles, and capability decisions. The objective is not a perfect score; it is comparable scenarios that support decisions.
Read analysis
WebAuthn uses public-key credentials scoped to a relying party and mediated by an authenticator. Phishing resistance improves, but deployments fail when recovery, lost devices, and domain changes are treated as afterthoughts.
Read analysis
HTTP/3 carries HTTP semantics over QUIC, which uses UDP and integrates TLS. It can reduce cross-stream blocking and improve some paths, but networks, middleboxes, and policy may prevent connectivity, so rollout needs real comparison.
Read analysis
NIST published the final SP 1326 on 8 July. It is voluntary US technical guidance, not Portuguese law, but it provides a concrete way to decide how much investigation is needed before appointing a critical supplier.
Read analysis
NIST has opened SP 800-213 Rev. 1 for comment until 24 August. It is a draft for US federal systems, not a final standard or Portuguese law, but its question is universal: which concrete capabilities must the product provide for the system to manage risk?
Read analysis
Portugal's regime transposing the European Accessibility Act has applied since 28 June 2025 to covered products and services. In e-commerce, evidence must cover the complete journey — information, identification, purchase, payment, support, and assistive technologies.
Read analysisHow we publish
Every analysis links the official documentation it relies on.
We translate change into decisions, owners and evidence.
We update the analysis when facts or guidance change.
We disclose generated photography and credit documentary photography.
From context to execution
We map the problem, write the scope and build the solution with acceptance criteria.
