AI Behind the Boundary
Waiting for an approved cloud often leaves the most sensitive data with the least help. This paper shows how to run AI inside your own boundary, even disconnected, with sourced answers and a tamper-evident audit trail.
White papers
Short papers on hard problems.
Practical, standards-based thinking on applied AI, security, modernization, data and the workforce, written for the leaders in companies and agencies who have to make the call. No product pitches.
The papers
Zero Trust Doesn't Stop at the Model
Agencies face a zero trust mandate (OMB M-22-09) and a push to expand AI use (OMB M-25-21); run separately, they collide at the model. This paper treats AI as a governed resource in a NIST SP 800-207 architecture, mapped to the OWASP Top 10 for LLM Applications (2025 edition) and MITRE ATLAS. The same approach fits companies running models on their own networks.
From Data to Decision
A fluent summary you cannot check is a confident guess. This paper describes evidence-grounded AI that turns messy, multilingual inputs into analysis a leader can act on and defend, with every claim tied to its source.
Modernize Like You Mean to Keep It
Big-bang rewrites of critical systems tend to fail. This paper argues for replacing legacy systems one function at a time behind a stable interface (the strangler-fig pattern), moving to the cloud where it fits and keeping off-ramps open.
From Dashboards to Decisions
Too much analytics ends at a dashboard nobody acts on. This paper shows how to start from the decision, give it a named owner, tie it to a defined action and measure the outcome.
Comprehension Is the Control
On safety-critical work, onboarding proves people attended, not that they understood. This paper treats comprehension as a measurable control, checked in the worker's own language, using the Kirkpatrick model and OSHA's expectation that training be given in a language workers understand.
De-risking Federal AI Acquisition
Buying AI is different from buying software. This paper shows program offices how to turn the NIST AI Risk Management Framework 1.0, OMB M-25-21 and GAO's AI Accountability Framework into contract language, independent test criteria, drift monitoring and off-ramps.
Your AI Is Only as Good as Your Data
Data, more than the model, decides whether AI works. This paper sets out measurable dimensions of AI-ready data (completeness, accuracy, timeliness, representativeness and traceability), the failures that hide in it, and a continuous loop to keep it trustworthy.
Proving the Machine
A working demo proves nothing yet. This paper covers AI test and evaluation: functional testing, behavior on noisy or unexpected inputs, and red-teaming against MITRE ATLAS and the OWASP Top 10 for LLM Applications (2025 edition), run as a continuous lifecycle.
How we write them
Written for the people who make the call.
Each paper is aimed at program managers, security leaders and operators. The reasoning rests on public standards and guidance (NIST, CISA, OMB, GAO, OWASP and MITRE), so you can check it yourself.
NIST AI RMF 1.0
NIST AI 600-1
NIST SP 800-207
OWASP Top 10 for LLM Applications (2025)
MITRE ATLAS
OMB M-25-21
OMB M-22-09
EO 14028
CISA Zero Trust Maturity Model v2.0
DFARS 252.204-7012
GAO-21-519SP
Keep going
Have a hard problem of your own?
Read our articles for shorter takes, or tell us what you are working on and we will say plainly whether we can help.