All writing
Incident response
Postmortems, forensics, and what response actually means once the fire is out.
Articles in this collection
3 articles- How to Build an Agent Audit Trail Before You Need ItThe provider's copy expires on their clock. Build the trail you own — context snapshots, provenance, a config hash, into storage the agent can't rewrite.#agentic-ai#incident-response#detection-engineering9 min read
- Your AI Agent Has No Audit TrailWhen an agent incident needs explaining, the evidence is already gone — context evaporates, and the provider's copy expires on a clock you don't set.#agentic-ai#ai-security#incident-response8 min read
- The Incident Isn't Over When the Fire's OutContainment ends the emergency. It doesn't end the investigation — and skipping the second part is how the same breach happens twice.#incident-response3 min read