SS Shihan Suhail Risk · Compliance · AI

Writing

Field notes on risk, compliance & AI

Practical, opinionated essays from the audit and cloud trenches. 28 published, more in progress.

Timeline
Topic
01 · 6 min read

A First Line of Defence Against Prompt Injection, in Python

The moment you put an AI chatbot in front of the public, people start trying to talk it into misbehaving. Here's a small Python guard that screens user input for the common prompt-injection tricks before it ever reaches the model…

AISecurity
Read →
02 · 6 min read

A Tamper-Evident Audit Log for AI Usage, in Python

Compliance regimes are starting to ask a hard question: what exactly did your AI do, and can you prove the record wasn't changed after the fact? Here's a small hash-chained audit log in Python that answers both…

AIGRC
Read →
03 · 6 min read

Strip the PII Before It Ever Reaches an AI, With Python

The moment a colleague pastes real customer data into a public AI tool, you've made a data transfer you probably can't account for. Here's a small Python redaction gate that removes the personal data before the prompt ever leaves your systems…

AISecurity
Read →
04 · 6 min read

Catch Expiring TLS Certificates Before They Take You Down, With Python

An expired TLS certificate is one of those failures that takes down a perfectly healthy service for an entirely avoidable reason. Here's a small Python tool, standard library only, that checks certificate expiry for a list of hosts and fails your pipeline before the outage finds you…

SecurityAutomation
Read →
05 · 5 min read

How I Built a Chatbot for wagah.lk on a Mac Mini

Customers kept asking the same handful of questions on WhatsApp. Is this in stock, how much is it, do you deliver to my town. So I built a chatbot for the store and ran the whole thing locally on a Mac Mini to keep the bill at zero…

AIChatbot
Read →
06 · 5 min read

Securing Your AI Chatbot With a Free Cloudflare Tunnel

After I put a chatbot on the store running off a Mac Mini at home, the obvious problem was how to let the website reach it without opening my home network to the world. A free Cloudflare Tunnel turned out to be the clean way to do it…

AISecurity
Read →
07 · 8 min read

Scanning Terraform Against Azure Policy at Build Time in Azure DevOps

Azure Policy stops noncompliant resources at deploy time. This shows how to catch the same violations earlier, in the Azure DevOps build, so a bad Terraform plan fails the pipeline instead of the deployment.

AzureSecurityGRC
Read →
08 · 6 min read

Strengthening Your Cloud Security Posture with Microsoft Defender for Cloud

Knowing where your cloud environment is weak is half the battle. Microsoft Defender for Cloud gives you a continuous read on your posture and maps it straight to the standards you have to comply with.

AzureSecurityGRC
Read →
09 · 7 min read

What the EU AI Act Means for Risk and Compliance Teams

The EU AI Act is the first comprehensive law to regulate AI by risk. For compliance teams the question is no longer whether it applies, but which of your AI systems fall into which tier, and what each tier demands.

AIGRCRisk
Read →
10 · 7 min read

Running Terraform in Azure DevOps Pipelines

A practical Azure DevOps pipeline for Terraform: remote state in Azure Storage, a plan you review before it runs, and an apply that only happens after someone approves it.

AzureAutomation
Read →
11 · 6 min read

Enforcing Compliance Guardrails with Azure Policy

Most cloud governance problems are not technology problems, they are consistency problems. Azure Policy lets you turn your security and compliance rules into guardrails that apply automatically across every subscription.

AzureGRCSecurity
Read →
12 · 7 min read

SOC 2 vs ISO 27001: Choosing the Right Framework (or Running Both)

The question I get asked more than any other is whether a company should pursue SOC 2 or ISO 27001. They overlap heavily but they are not the same thing, and the right answer depends on who is asking you for it.

SOC 2GRCRisk
Read →
13 · 6 min read

Deploying Bicep from Azure DevOps Pipelines

Bicep gives you clean, typed infrastructure as code for Azure, and Azure DevOps gives you a place to validate and ship it safely. Here is a pipeline that previews every change before it touches production.

AzureAutomation
Read →
14 · 6 min read

Eliminating Hardcoded Secrets with Azure Key Vault and Managed Identities

Connection strings and API keys sitting in config files are still one of the most common ways credentials leak. Here is how to get them out of your code for good using Key Vault and managed identities.

AzureSecurityAutomation
Read →
15 · 7 min read

Preparing for DORA: Operational Resilience for the Financial Sector

DORA reframes ICT risk as an operational resilience problem the board is accountable for, not an IT problem buried in a basement. Here is how I read its five pillars and where firms should focus.

GRCRiskSecurity
Read →
16 · 4 min read

Evaluating SOC 2 Type II Reports as a Cybersecurity Engineer

It is important to understand that data is a key element of modern society, the lifeblood of business data in the present era. As such, cybersecurity executives are required to…

SOC 2Security
Read →
17 · 3 min read

Will AI Agents Disrupt GRC Workflows? Yes - and Here's Why

Will AI Agents Disrupt GRC Workflows? In the ever evolving cybersecurity and compliance landscape, Governance, Risk, and Compliance GRC workflows have long been cumbersome, time intensive, and manual. But changing…

GRCAI
Read →
18 · 2 min read

Azure Landing Zone Review Assessment

Introduction Organizations are constantly searching for methods to harness the potential use of the cloud to operate their operational architecture and compete in today’s fast paced digital environment. As a…

Azure
Read →
19 · 2 min read

Implementing SOC 2 Compliance Framework

Introduction I have implemented SOC 2 compliance and am aware of the challenges. SOC 2 ensures that customer information is secure. The framework provides guidelines for security, availability, processing integrity,…

SOC 2GRC
Read →
20 · 2 min read

Automating Azure Resource Graph Queries with Logic Apps

Overview Azure Resource Graph Explorer enables querying resources at scale across subscriptions, management groups, and entire tenants. If you need to execute queries periodically and take action on the results,…

AzureAutomation
Read →
21 · 3 min read

Guide to Connecting OpenAI with Azure Portal

The integration of the OpenAI model into the Azure ecosystem gives organizations an unprecedented opportunity to harness the power of AI for a variety of applications. Microsoft Azure makes this…

AIAzure
Read →
22 · 3 min read

How to Import Azure Wiki Contents into a JSON File

In today's digital age, organizations often depend on collaborative tools like Azure Wiki to streamline knowledge sharing among team members. However, there are situations when you might need to export…

AzureAutomation
Read →
23 · 1 min read

How to Resolve VSS Writer Errors Without Rebooting

Resolve VSS Writer Errors Without Rebooting How to Resolve VSS Writer Errors Without Rebooting Scenarios Scenario 1: Failed VSS Writers Backups fail due to VSS writers in a failed state,…

Infrastructure
Read →
24 · 1 min read

Veeam Known Issues: Network Failure and SSL Errors

Veeam Known Issues: Error Observed by Underlying BIO Issue Discontinuous network failures may occur when communicating with the VMware host. This is accompanied by errors such as: “Error observed by…

Infrastructure
Read →
25 · 3 min read

Simplifying Access Control: Introducing Temporary Access Passes in Azure

Overview In today’s ever changing business environment, it is often necessary to grant temporary access to resources within the Azure platform. Whether it be for a brief project, contractor involvement,…

AzureSecurity
Read →
26 · 3 min read

Configure Front Door For An Azure App

For content and apps, Azure Front Door is a cutting edge cloud content delivery network CDN service that offers high performance, scalability, and secure user experiences. This can be set…

Azure
Read →
27 · 4 min read

Monitoring on premises devices with Sentinel using Azure ARC

When talking about Hybrid clouds & multi cloud environments the main requirement is to monitor on premise devices. And yes when it comes to Azure cloud the monitoring is way…

AzureSecurityAutomation
Read →
28 · 5 min read

Using mTLS for your Organization

We used to do secure communication over the internet using TLS. After attacks such as POODLE made SSL 3.0 unsafe, mTLS (Mutual Transport Layer Security) was introduced to make client and server connections secure and trusted…

SecurityInfrastructure
Read →