The whitepapers your AI vendor didn’t want you to read.
Vendor-neutral, operator-written, and free. No email wall until you actually want one. Read first, keep it if it’s useful.
The Enterprise AI Reference Model (EARM™)
Published October 2026 · PDF · Free download
There isn’t one AI governance layer. There are seven. EARM lays them out bottom to top, the way the OSI model is taught, so you can show a board which floors you’ve built and which ones are missing.
The Off Switch Problem
Published October 2026 · PDF · Free download
Big banks can block an outside AI agent at the login page. Inside the perimeter, most companies can’t name every agent, say who owns it, or stop one without stopping the person whose credentials it borrowed. Here’s why, and what a working off switch takes.
Same Model, Different Contract
Published October 2026 · PDF · Free download
ChatGPT, Claude, Copilot, Gemini, Kimi, and open-weight models, tier by tier against SOC 2, GDPR, and HIPAA. The model is the same across tiers. The contract is what changes.
The CISO of the Future
Published September 2026 · PDF · Free download
The CISO role is moving from running controls to owning business resilience. Both models side by side, the five outcomes the new role is measured on, and a roadmap for getting there before the business asks.
Is Someone Inside Your Phone?
Published September 2026 · PDF · Free download
Spyware no longer needs you to click anything. Amnesty’s free forensic toolkit can check your own iPhone in an afternoon. Here is the walkthrough, including where the docs and reality diverge.
The 4,217 Logins Nobody Approved
Published August 2026 · PDF · Free download
Your employees log into consumer AI tools thousands of times a month, and almost no board has seen the number. How to measure shadow AI from the outside in, and what to do once you have it.
The Layer You Don’t Think You Need
Published August 2026 · PDF · Free download
The AI governance layer nobody puts on the roadmap is the one you cannot operate without in two years. The same argument the enterprise already had about the hypervisor, logging, and single sign-on.
The Risk You Didn’t Put on the Register
Published August 2026 · PDF · Free download
Agents put four risks on your balance sheet. Buy-versus-build is really a decision about who carries each one, and a regulator’s deadline is already on the calendar.
Please Stop Giving Your AI a Shell
Published August 2026 · PDF · Free download
CLI or MCP? The wrong question. Here is the governance property that actually decides whether your risk, audit, and legal teams can attest to what your agents can do.