Blog

Risk program strategy and practitioner notes on AML/CFT, fraud, enterprise risk, AI risk, and CMMC.

Founder Notes

The Diagnostic Your Risk Program Is Missing

September 21, 2026

A diagnostic tells you what's actually wrong, not what might be. Most risk assessments never clear that bar. Here's why that gap exists, and what changes once you close it.

Founder Notes

Three Uncomfortable Truths About Your Last Risk Assessment.

September 3, 2026

A thermometer gives the same reading no matter who's holding it. A traditional risk assessment doesn't - not because the people running it are careless, but because none of it was built to work like a measurement in the first place. Here are three reasons why, and why doing the same process more carefully doesn't fix any of them.

AML/CFT

The Risk Assessment Illusion

August 24, 2026

Most risk assessments are accurate the day they're signed and wrong from there. Here's why that gap exists, why regulators are done tolerating it, and what actually closes it.

Founder Notes

Where Does Your Risk Strategy Actually Come From?

August 17, 2026

Most risk strategies aren't derived from data. They're an opinion, backed after the fact by whatever pentest or assessment happens to be lying around. Here's why that's the default, and what it costs.