Written to support decisions, not just fill a blog
Attomus shares practical insight on resilience, technology delivery, specialist security, and operational risk.
Insights
Attomus Blog
Practical Attomus insight on cybersecurity, programme delivery, operational risk, and related issues in demanding environments.
The Authentication Model Contradiction Nobody Talks About
Authenticator apps look simple. They generate six-digit codes. The cryptography is forty years old. The protocol is an IETF RFC from 2011. You could probably implement the core algorithm in a lunch break. The genuinely hard part isn’t the TOTP maths. It’s a design tension baked into the product category itself, one …
Read article'Military-Grade Encryption' and Other Phrases That Should Make You Reach for Your Notes
Somewhere in nearly every security product’s marketing sits the phrase “military-grade encryption”. Pause on what that phrase actually tells you. The honest answer is: that the vendor employs a marketing department. There is no military grade. The world’s militaries use, for the most part, the same published algorithms …
Read articleWhat Android's Keystore Actually Does with AES Keys (and What It Doesn't)
There is a question that comes up constantly in Android security engineering, usually phrased something along the lines of: “how do I prove to my server that this AES key is hardware-backed?” The common answers to this question are often wrong in that they make you think you have a guarantee that you do not have. The …
Read articleWhen Your Next Customer Is an AI Agent: Trust, Identity, and Provenance on the Agentic Web
A growing share of the traffic arriving at any organisation’s website is no longer human. Some of it is the familiar crawling of search engines. But an increasing fraction is something newer: AI agents acting on behalf of specific people – researching a purchase, evaluating a supplier, summarising a market, …
Read articleThe Wrong Way to Market a Security Product, and What to Do Instead
“Military-grade encryption.” “Zero-knowledge architecture.” “Bank-level security.” “Secure enclave protection.” These phrases appear all over the App Store listings for security products, and most of them are meaningless, misleading, or too vague to be useful. The damage they do reaches well beyond the individual …
Read article