· 1 min read
What does a SOC 2 actually verify?
The report every vendor waves and almost nobody reads. Four hundred words on what the attestation covers, and the question it cannot answer.
#diligence#security#vendors
Diligence
7 articles
· 2 min read
What happens when the system is presumed correct?
The Post Office Horizon scandal is the definitive case study in machine authority. A briefing on its architecture lesson, which is not the one about bugs.
#authority#audit#evidence
· 1 min read
What does August 2nd ask of your architecture?
The EU AI Act's high-risk obligations begin applying in weeks. Most of the readiness work is architecture, not paperwork. The two-week version.
#regulation#ai#diligence
· 2 min read
How many nines do you need?
Availability targets are purchases, and each nine costs roughly ten times the last. Pricing the promise before signing it.
#diligence#availability#slo
· 4 min read
What does technical debt cost, in numbers someone will sign?
The metaphor is twenty years old and the invoices are real. A briefing on pricing debt honestly, with the two industry estimates worth citing and their limits.
#technical-debt#diligence#economics
· 3 min read
How deep does your dependency graph go?
On June 12 a Google Cloud failure took down Cloudflare services, which took down their customers. Three levels of transitivity, one afternoon. A briefing.
#dependencies#reliability#cloud
· 2 min read
What does technical due diligence actually check?
Not code quality. Diligence prices three risks: key people, standing obligations, and the distance between the story and the system.
#diligence#risk#acquisitions