Writing
The thinking is public. The build is not.
On the gap between an approved instruction and a legitimate one, the losses institutions do not yet count, and cryptography that has to outlive the machines it is defending against. Newest first.
Series
Complete series · Four parts · September–October 2026
The Uncounted
Two measured categories of loss, and a third that neither captures. Four South African cases from the public record, read as one pattern.
4 / 4 published
Now publishing · No. 02 of 05Before It Becomes Materiala newsletter for boards
- IThe three weeks nobody countsDwell time, and the interval financial-sector controls and disclosures were never designed to measure.Read →
- IIOne provider, many perimetersThird-party concentration, and why an institution’s own controls cannot see the environment that now holds its clients’ data.Read →
- IIIThe request that looked legitimateTrusted channels, and what happens when a process is followed correctly and the request itself is fraudulent.Read →
- IVIdentity at the sourceWhat happens to onboarding checks once the documents they depend on are themselves in circulation.Read →
LinkedIn newsletter · Five editions · From November 2026
Before It Becomes Material
For boards and risk committees. Where The Uncounted documents the interval before an incident is reported, this series asks what a board can measure inside it, and what it should ask before an exposure becomes material.
- The Instruments a Board Does Not Yet HaveFour measures of dwell time, built from records institutions already keep, or soon will.2 Nov 2026 · Read ↗
- The Post-Quantum Deadline Arrives Through the SupplierWhy South African institutions will inherit the timetable through procurement rather than regulation.9 Nov 2026 · Read ↗
- When Prevention Became a Results-Day NumberWhat the new prevention figures measure, what they cannot, and what boards should ask to see beside them.Forthcoming
- The Keys, Not the CodeWhat digital-asset losses reveal about where security fails.Forthcoming
- What the 24-Hour Clock Does Not SeeWhat Joint Standard 2 measures, and what it leaves to the board.Forthcoming
Articles
- Nov 2026The Post-Quantum Deadline Arrives Through the SupplierWhy South African institutions will inherit the timetable through procurement rather than regulation.LinkedIn ↗
- Nov 2026The Instruments a Board Does Not Yet HaveFour measures of dwell time, built from records institutions already keep, or soon will.LinkedIn ↗
- Feb 2026The Ferry HeistWhat the 2025 losses on cross-chain bridges reveal about the infrastructure we are building, and where security actually fails.LinkedIn ↗
- Feb 2026The Quantum MandateWhy new financial infrastructure can win the post-quantum race that incumbents are already running late.LinkedIn ↗
Papers & carousels
- Apr 2026The Institutional ConvergenceFour institutional signals published independently in the first quarter of 2026, converging on the same conclusion about cross-network security.Paper · PDF · 7 pp
- Mar 2026Shifting the Trade-Off CurveHow post-quantum architecture changes the security calculus, and why the cost of deferral is no longer symmetric.Carousel IV · PDF
- Mar 2026The Independent Failure Domains DoctrineCross-chain infrastructure has three independent failure domains. Post-quantum cryptography addresses one.Carousel III · PDF
- Mar 2026Inside the Attack SurfaceValidator architecture, the economics that make attack rational, and the laundering dimension the 2025 data makes visible.Carousel II · PDF
- Mar 2026The Settlement LayerWhat the 2025 loss data reveals about the infrastructure beneath CBDCs, stablecoins and cross-border settlement.Carousel I · PDF