Practitioner writing on enterprise AI, security and digital trust.
Checklists, frameworks and sector briefings written by the people who run the assessments and build the systems — for CISOs, DPOs, CIOs and boards who need to make a decision, not read a trend piece.
Three pieces that answer the questions we hear most.
The DPDP Compliance Checklist for 2026
If you read one piece before a board or regulator asks about DPDP, read this one.
The AI Security Checklist Every CISO Needs
The fastest way to find out whether your AI features are inside or outside your current security programme.
Enterprise AI Agents: What Actually Works in Production
For anyone with a pilot that impressed the demo audience and has not shipped since.
All three are already written up as downloadable papers, alongside five more on VAPT cadence, AI system registers, prompt injection, KYC data retention and data residency.
Open the whitepaper libraryWhat we write about, and why.
We publish on the three subjects we work in every day — AI in production, AI and cyber security, and digital trust under the Digital Personal Data Protection Act — because the questions our clients ask on scoping calls are the same questions every other regulated enterprise in India is asking. Writing the answers down once is more useful than repeating them.
- Enterprise AI — agents, automation, private AI and what it takes to run them after go-live
- AI security and cybersecurity — LLM and agent attack surfaces, testing methods, and how they fit existing security programmes
- DPDP and digital trust — consent, data governance, AI governance and evidence, by sector
- Sector briefings — banking and NBFC, healthcare, government, education and logistics
Written for you if you are…
- A CISO or security head deciding how AI features fit into your testing and risk programme.
- A DPO or compliance head who needs a DPDP programme, not a policy template.
- A CIO, CTO or CDO choosing what to build, buy or run privately.
- A CEO, board member or audit committee who needs the risk explained in one page.
- A government or institution technology leader working with procurement and public accountability constraints.
Practitioner-written, reviewed, kept current.
Drafted by the practitioner
Each piece is written by the specialist who does that work — the person who runs the red team, the DPDP assessment or the agent build.
Reviewed across disciplines
Security reviews the AI pieces, privacy reviews the security pieces. Legal statements about DPDP are kept general and accurate rather than speculative.
Updated as regulation moves
DPDP rules, sector guidance and AI policy are still moving. Pieces are revised and dated when they change materially.
Evidence over claims
No invented statistics, no case studies we cannot name. Where we cite numbers, they describe a method, not a promised result.
Indian regulatory context first
Written from the DPDP Act and Indian sector regulators outward, not adapted from GDPR commentary.
Decision-oriented
Every piece ends with what to do next and who should own it — the same standard we hold our assessment reports to.
Browse by topic.
Filter by subject area. Every card says where it goes before you click it. Eight of these topics are already covered by a downloadable research paper — those cards open the whitepaper library. The rest are still being written, so their cards ask a specialist to send you the brief rather than pretending the article is there.
The DPDP Compliance Checklist for 2026
A working checklist of what a data fiduciary needs in place — notices, consent records, data principal request handling, breach notification readiness and processor contracts — ordered by how long each takes to fix. Written for DPOs and compliance heads who need to brief a board on where the organization actually stands.
The AI Security Checklist Every CISO Needs
The controls that matter for LLM applications, agents and RAG pipelines, mapped to the attack paths they close: prompt injection, data exfiltration through tools, excessive agency and model access. Includes the questions to ask a vendor before their copilot touches your data.
Enterprise AI Agents: What Actually Works in Production
Why most agent pilots stall at the demo, and the design decisions that separate the ones that ship: narrow scopes, deterministic tools, approval gates and observability from day one. A practical piece for CTOs and heads of engineering deciding what to build next.
AI Governance in India: Where Policy Is Heading
A read of the current direction of Indian AI policy and sector regulator expectations, and what a defensible governance baseline looks like before rules firm up. For CIOs, CDOs and risk heads who need to act now without over-building.
LLM Security: A Practitioner’s Primer
The core categories of LLM risk — jailbreaks, injection, leakage, unsafe outputs, supply chain — explained with concrete examples rather than taxonomy. Shows how red teaming, automated testing and runtime controls map to each category so a security team can decide what to buy and what to build.
An Honest AI Implementation Strategy for Regulated Enterprises
A sequencing model for AI adoption in a bank, hospital or government department: which use cases first, what data and security work must precede them, and where human oversight is non-negotiable. Written to be handed to a CEO who wants results without a regulatory finding.
Ten AI Automation Use Cases That Actually Pay Back
Document and process automation candidates — KYC intake, claims, invoice matching, contract review, ticket triage and more — with the conditions under which each one works and the data prerequisites that usually get skipped. For COOs and operations heads building a business case.
The Case for Private Enterprise AI
When running models inside your own boundary is worth the cost, and when a public API with the right contracts is the better answer. Covers data residency, DPDP obligations, latency, model choice and the operating burden nobody budgets for.
AI Risk Management: A Framework for Boards
How a board or audit committee should be briefed on enterprise AI risk: an inventory of systems in use, the decisions they influence, the controls around them and who is accountable. Includes a one-page briefing structure directors can ask management to fill in.
DPDP for Fintech: What NBFCs Get Wrong
The recurring gaps in lending and payments products: bundled consent at onboarding, data sharing with collection and analytics partners, and retention that outlives the loan. What to fix first and how to evidence it.
DPDP for Healthcare: Consent Beyond the Discharge Form
Why patient consent captured at admission does not cover diagnostics partners, insurers, research and AI tools that later touch the record. A practical view of consent that travels with the data across a hospital group.
DPDP for Schools: Protecting Student Data by Design
What schools and universities should check before rolling out an ed-tech platform: guardian consent, purpose limitation, retention, vendor access and what happens to data when a student leaves. Written for principals, IT heads and trust boards, most of whose users are minors.
AI Security for Banks: A Sector Briefing
How BFSI security teams are folding LLM and agent risk into existing frameworks — threat modelling, third-party risk, change control — rather than building a parallel programme. Includes the control areas we see most often left uncovered.
Cards marked “Download the paper” open the whitepaper library, where the topic is covered in depth — sometimes under a different title. Cards marked “Request this brief” go to the contact form: the article is not published yet, and a specialist will send you what exists today, including the version for your sector.
Want research specific to your sector?
Tell us what you are evaluating — a regulation, a vendor, an AI use case — and a specialist will point you to the relevant work or write the brief.