Written to support decisions, not just fill a blog
Attomus shares practical insight on resilience, technology delivery, specialist security, and operational risk.
Insights
Attomus Blog
Practical Attomus insight on cybersecurity, programme delivery, operational risk, and related issues in demanding environments.
Zero-Knowledge Proofs: Proving Without Revealing, Separating Substance From Theatre
A zero-knowledge proof lets one party prove to another that a statement is true whilst revealing nothing beyond the truth of the statement itself: not the evidence, not the underlying data, not the working, only the fact. It sounds like a conjuring trick, and most people, hearing it described, assume it cannot be done. …
Read articlePost-Quantum Cryptography: A Migration Guide for People Who Dislike Panic
The short answer first: the quantum threat to public-key cryptography is real, it is not imminent, and almost everything needed to deal with it in an orderly fashion already exists. That combination is rare in security. One audience is told the sky is falling and sold “quantum-safe” products of uneven seriousness; …
Read articleWho Holds the Keys? The One Question That Decides Everything Else
Every conversation about data security eventually arrives, or should arrive, at the same place. Not “is the data encrypted?” – almost everything is encrypted now, in some sense, somewhere. The question that actually determines your position is: who can use the keys without your participation? It is striking how much …
Read articleWhat End-to-End Encryption Actually Guarantees — and What It Quietly Doesn't
Few phrases in technology have travelled as far from their technical meaning as “end-to-end encrypted”. It now appears on platforms whose architectures differ so fundamentally that the shared label conveys almost nothing. For an organisation deciding where its sensitive communication should live, the label is the start …
Read articleTrust Through Mathematics, Not by Contract
Ask most organisations why they trust a supplier with their data, and the answer, once unpacked, is a stack of paper. A contract with a confidentiality clause. A SOC 2 report. An ISO 27001 certificate. A data processing agreement. Perhaps a redacted penetration-test summary. Each of those documents says, in essence, …
Read article