Security, written by the people
who are awake when it fails.
What the news means for a team that runs production. AI services, AI-built apps, supply chain worms, logs as a data-protection surface, and what we found when we turned the scanners on ourselves. Every piece names its sources. None of it promises compliance.
The news, and what to do about it
Each piece opens on what happened, explains why reasonable decisions produced it, and says what to do in the order that matters.
Running AI in production: what I took to the Datadog Secure panel
Why AI changed code generation but not the fundamentals, the pipeline we run, the evidence an AI service needs, and the one action for the next 90 days.
Read →The NCSC handled 1,831 incident reports this year. Here is what that means if you have three engineers
The figures, the three familiar ways in, the arithmetic of who is awake, and five things to do in order.
Read →Every AI-built app breach of 2026 had the same missing control
Moltbook, Chat & Ask AI, Lovable and the RedAccess scan: four platforms, one cause, a backend that trusted the client. Six checks for tonight.
Read →Your logs are a data-protection surface, and the scanner you paid for is probably off
Why Sensitive Data Scanner is off in the estates we review, why redaction can hide the real problem, and what to switch on in order.
Read →The worm walked in through the packages you trust. Removing it does not end the incident
Shai-Hulud and ChainDrop: three defaults that made them work, why the runner is the most privileged machine you own, and the order to respond in.
Read →Nearly half of AI-generated code fails a security test. Shift-left was never going to be enough
Veracode's 2026 figures, why the scanner cannot fix a constant rate at rising volume, and what has to run after the merge.
Read →Before an AI service goes live: the readiness checklist
Thirty checks across visibility, ownership, stopping, reach, data, evidence, quality and supply, each with the evidence to keep.
Open →We ran a ransomware tabletop on ourselves. Three things we only learned by running it
The channel that works when the identity provider is down, the clock that starts before the investigation, and who signs "back to normal".
Read →A new scanner integration sent our risk score through the roof. Almost none of it mattered
Vulnerability noise has the same shape as alert noise. Four rules that fix both, from our own ISMS review.
Read →The security trial that showed nothing, and why scope is the whole game
A trial we ran badly, what it found anyway, and the five rules every Datadog security trial now runs by.
Read →Is your MSP a data processor? The question to ask, and the facts we give you to answer it
Access and processing are not the same thing. The ICO's definitions, five questions for any provider, and how we answer them.
Read →The dev account nobody secured is the production account's neighbour
Why the account with nobody's name on it is the way in, why it was never a decision, and the rebuild that holds.
Read →Audit logging is often too expensive to switch on. That is a design choice, not a verdict
Retrievable is not searchable. The three-tier design that keeps audit logs queryable for as long as the obligation says.
Read →How to answer a security questionnaire when you built the app with AI
The twelve questions that always appear, what an honest answer looks like, the control behind each, and the evidence that turns it into a yes.
Open →Need the controls on, routed to a person, with the evidence kept?
Critical Cloud operates and evidences the runtime controls that support your obligations: detection to a named engineer, access and secrets hygiene, logs handled as data, backups that restore. We operate the stack. You own the product.