Field notes

Running one audit programme across jurisdictions, funders, and frameworks without multiplying the evidence-collection work.

Folding AI-specific controls into an existing ISO 27001 / NIST CSF programme instead of standing up a separate framework nobody maintains.

Using an agentic SOC AI (Dropzone AI) to carry alert triage so a two-person team can spend its hours on what actually needs a human.

A practitioner’s framework for bringing shadow AI adoption under an existing security governance model.

Notes on the operational and organizational failure points that show up before the technical ones do.