Public notes by Ruairidh Hastie, collected as part of the About section. They are general thinking and practical writing, not bespoke advice or a separate consultancy offer.
A practical argument for treating AI adoption like earlier waves of shadow IT: visible enough to help, structured enough to govern, and honest enough to find the risk before it becomes folklore.
A clear look at how AI tooling decisions move beyond demos into exposure, data handling, auditability, and the uncomfortable questions teams need to answer before rollout.
A field note on moving from messy reality into a structured security programme, where compliance becomes useful because it makes trust visible every day.
A position piece on treating AI in development as more than acceleration: it has to support secure, compliant, future-proof delivery rather than becoming another unmanaged shortcut.
A reminder that management platforms often provide signals rather than certainty, and that incident response depends on knowing the difference between managed, patched, and confidently known.
A short breach-response note about CEX, stored card data, GDPR pressure, and the cost of waiting until after an incident to take security seriously.
An older but still useful security-awareness piece about breach notifications, password hygiene, and using alarming headlines as a prompt for calm action.
A practical checklist-style security piece from the earlier archive, useful for turning evergreen advice into a refreshed Hastie & Co guide.