Engineering, architecture,
and the AI governance stack.
Writeups from the team building Themisto Labs. Architecture decisions, category thinking, and the failure modes we design around.
Is ChatGPT Enterprise Safe? What It Covers and What It Leaves Open
ChatGPT Enterprise protects the data that goes through ChatGPT Enterprise. The gap is everything else your employees use: personal accounts, other models, and native apps you never approved. Here is the honest scope, and how to close the rest.
AI Data Loss Prevention: Why the Endpoint Beats the Network
Traditional DLP watches the network, but AI prompts are encrypted the moment they leave the machine, so the network sees ciphertext and nothing more. Endpoint-level DLP reads the prompt where it is still plaintext. Here is the architectural reason one works for AI and the other does not.
We Watched 5 Laptops for 5 Days. Leadership Had Estimated Zero AI Usage.
Field notes from a real deployment: a 30-person company, five work devices, and 2,888 AI requests that nobody in the leadership meeting saw coming.
Is DeepSeek Safe for Work? Your Employees Already Answered for You
Governments have banned it from official devices, security teams keep finding it in traffic logs, and employees love it because it's free and good. What to actually do about DeepSeek at work.
How to Write an AI Acceptable Use Policy People Actually Follow
Most AI acceptable use policies fail because they are unenforceable wishes: a PDF that says do not paste secrets into ChatGPT, with nothing watching whether anyone does. Here is how to write one that maps to real controls, plus the structure and clauses to start from.
The EU AI Act Gets Real on August 2, 2026. Most Companies Are Not Ready to Prove Anything.
Next month the bulk of the EU AI Act becomes applicable, including the high-risk regime. The gap in most compliance programs isn't policy. It's evidence.
Agentic Browsers Are Showing Up at Work, and Your Security Stack Thinks They're Chrome
Employees are installing browsers where an AI reads pages, clicks buttons, and fills forms with their logged-in sessions. Most security tooling can't tell the difference. That's a problem.
The Rise of AI Agents Creates a New Governance Problem
AI agents combine data access, decision-making, and execution. That autonomy breaks governance models built around discrete actions performed by identifiable human users.
The Audit Trail Problem: Why Most Companies Cannot Prove What Data Their AI Touched
Most organizations cannot reconstruct which employees shared what data with which AI models. Closing that audit gap is becoming a prerequisite for credible AI governance.
Why AI Governance Is Following the Same Path as Endpoint Security
Existing controls each see only part of AI activity across organisations. Like endpoint security before it, AI governance is moving toward the device where identity, process, and data context converge.
Shadow AI Is Becoming a Board-Level Risk
AI adoption has moved beyond productivity experiments. Boards now need evidence that AI usage across the organisation is visible, auditable, and aligned with its risk appetite.
Why Traditional DLP Struggles With AI
Traditional DLP was built to inspect files and attachments. AI moves sensitive information through prompts, conversations, APIs, and workflows that no longer resemble document transfers.
Vercel Got Breached Because an AI Startup Employee Downloaded a Roblox Cheat
The April 20 Vercel hack has a one-sentence summary: an infostealer on one laptop at a tiny AI vendor became an OAuth skeleton key into a platform that ships half of DeFi's frontends. Here is how Context.ai, Lumma Stealer, ShinyHunters, and a Google Workspace OAuth grant chained together, and why shadow AI is now a board-level word.
What is AI Traffic Governance? A Technical Primer
AI traffic governance is the emerging category for controlling the unmanaged flood of LLM requests leaving business endpoints. Here is what it means, why existing tools miss it, and how we are thinking about the architecture.
Shadow AI: The Problem Security Teams Are Quietly Dealing With
Shadow AI is the gap between what employees are doing with LLMs and what security teams can see. The controls that closed shadow SaaS do not close this one, and the structural reasons why are worth understanding before buying anything.
mTLS for AI Proxies: Building Zero-Trust at the Process Layer
When an AI governance proxy sits in the path of every outbound model request, it becomes the most valuable target on the machine. This is the cryptographic design we chose and why bearer tokens were never going to be enough.
5 Ways Business Data Leaks Through AI Tools (And How to Stop It)
Business AI data leaks tend to take a small number of recognizable shapes. Each has a documented cause and each has a specific control that catches it. Here are the five patterns we designed Themisto Labs around.