The Regulatory Stack, Part 5: The Cyber Resilience Act Closes the Last Loophole
10 minutes
Think your AI agent escaped the EU AI Act's high-risk classification? The Cyber Resilience Act lands more than a year earlier, and it …
Blog
Insights and opinion from the Sakura Sky team.
Engineered Compliance: Beyond Templates
10 minutes
Regulators do not ask for documents. They ask for systems that behave a certain way and the ability to prove it. We introduce Sakura Sky's …
The Regulatory Stack, Part 4: Engineering Under the AI Act - Article 15 Cybersecurity in Practice
10 minutes
How to turn the EU AI Act's stringent cybersecurity requirements into a clean, automated side effect of your existing platform engineering …
The Regulatory Stack, Part 3: How the EU AI Act Made Verification a Legal Question, Not a Best-Practice One
13 minutes
The EU AI Act binds providers and deployers to a continuous, evidenced verification posture by December 2027. Here is the operational …
The Regulatory Stack, Part 2: Why the Boardroom Should Be Funding the Verification Layer in 2026
10 minutes
The capital deployment decisions boards make this year will determine whether their autonomous AI systems are governable assets or …
The Regulatory Stack, Part 1: AISVS Has 14 Categories. GATE Has 16 Controls. Here Is the Map.
11 minutes
AISVS tells you what to verify. The AI Act tells you that you must. Neither tells you how to enforce. This is the engineering map between …
OWASP Just Drew a New Map, Read It Before Your Auditors Do
9 minutes
The Foundation's new strategic plan is not a community update. It commits OWASP to setting the technical floor for AI security, …
The Mythos Ledger, Part 5: The Resilient Cloud Manifesto
11 minutes
The series finale. Across four posts, we identified three machine-speed problems - discovery, intelligence, identity - that share the same …
The Mythos Ledger, Part 4: Identity in the Autonomous Enterprise and Why the Agent Is the New Perimeter
13 minutes
Non-human identities now outnumber humans by 40:1, 100:1, and in hyper-automated environments by 500:1. When AI agents do 80–90% of an …
The Mythos Ledger, Part 3: The Glasswing Strategy (From Defensive Coalitions to Cloud Immunity)
11 minutes
Anthropic's $100M Project Glasswing is the first attempt to flip the economics of AI-driven vulnerability research before offensive …
The Mythos Ledger, Part 2: The Verification Crisis
19 minutes
AI-driven discovery has lowered the cost of finding bugs by an order of magnitude. The cost of proving which ones are actually exploitable …
The Mythos Ledger, Part 1: The Firefox Watershed and the New Baseline of Vulnerability
7 minutes
Claude Mythos surfaced 271 vulnerabilities in a single Firefox evaluation pass. The number isn't the story - the collapse in the cost of …