Articles on cybersecurity, governance, risk management, AI oversight, compliance, software engineering and operational resilience by Peter Vesely. https://www.vesely.sk/ en Fri, 07 Aug 2026 00:00:00 GMT 60 https://www.vesely.sk/blog/ai-security-architecture-is-not-just-ai-governance/ https://www.vesely.sk/blog/ai-security-architecture-is-not-just-ai-governance/ Fri, 07 Aug 2026 00:00:00 GMT AI governance defines policies and responsibilities. AI security architecture turns them into technical controls, trust boundaries, identity models, evidence and tests. AI Securityai-securitysecurity-architectureai-governanceai-actllm-securityrag-securityprompt-injectioniamzero-trustthreat-modelingaudit-evidencenist-ai-rmfowasp-llm https://www.vesely.sk/blog/docker-healthy-but-unreachable-after-hyper-v-to-proxmox-migration/ https://www.vesely.sk/blog/docker-healthy-but-unreachable-after-hyper-v-to-proxmox-migration/ Fri, 07 Aug 2026 00:00:00 GMT After moving an Ubuntu VM from Hyper-V to Proxmox, the VM network worked and the Docker container was healthy, but the application was unreachable because Docker did not restore runtime networking and port mappings correctly. Infrastructureproxmoxhyper-vdockerubuntunetworkingmigrationinfrastructuretroubleshootingoperationslinuxvirtualization https://www.vesely.sk/blog/migrating-windows-vm-from-hyper-v-to-proxmox-with-veeam-community-edition/ https://www.vesely.sk/blog/migrating-windows-vm-from-hyper-v-to-proxmox-with-veeam-community-edition/ Fri, 07 Aug 2026 00:00:00 GMT A practical migration lesson: Veeam Community Edition can restore a Windows Hyper-V VM to Proxmox, but a VirtIO SCSI boot issue may require a temporary SATA boot and a small helper VirtIO disk. Infrastructurehyper-vproxmoxveeamwindows-servervirtioscsisatavirtualizationmigrationbackupdisaster-recoveryinfrastructuretroubleshooting https://www.vesely.sk/blog/threat-modeling-for-llm-applications-where-to-start/ https://www.vesely.sk/blog/threat-modeling-for-llm-applications-where-to-start/ Fri, 07 Aug 2026 00:00:00 GMT LLM applications need threat models that cover more than prompts: trust boundaries, RAG, agents, tools, identity, data flows, provider boundaries and audit evidence. AI Securityai-securitythreat-modelingllm-securityprompt-injectionrag-securityiamzero-trustappsecaudit-evidenceowasp-llmmitre-atlasnist-ai-rmf https://www.vesely.sk/blog/when-a-virtual-server-is-not-just-a-disk-file/ https://www.vesely.sk/blog/when-a-virtual-server-is-not-just-a-disk-file/ Thu, 06 Aug 2026 00:00:00 GMT Moving a domain controller from Hyper-V to Proxmox can look like a simple virtual machine migration. In practice, Active Directory carries identity, DNS, time, trust and recovery assumptions. Infrastructurehyper-vproxmoxactive-directorywindows-serverdomain-controllervirtualizationbackupdisaster-recoveryincident-responseinfrastructurecybersecurity https://www.vesely.sk/blog/ai-generated-content-will-need-more-than-a-label/ https://www.vesely.sk/blog/ai-generated-content-will-need-more-than-a-label/ Mon, 03 Aug 2026 00:00:00 GMT AI transparency will not be solved by a small icon under an image. Organisations will need provenance metadata, signatures, watermarking, verification tools, human review and audit evidence. AIaiai-governancecompliancecybersecurityaudit-evidenceverificationprivacysoftware-security https://www.vesely.sk/blog/vibe-coding-builds-applications-who-builds-security/ https://www.vesely.sk/blog/vibe-coding-builds-applications-who-builds-security/ Thu, 30 Jul 2026 00:00:00 GMT AI can generate working applications quickly, but functionality is not the same as security. The next challenge is proving that AI-generated systems are hardened, compliant and trustworthy enough for production. AI Securityai-securitycybersecurityvibe-codingaiappsecdevsecopssoftware-securitysecure-by-designdockerzero-trustcomplianceaudit-evidenceverificationai-engineering https://www.vesely.sk/blog/ai-needs-better-engineering-not-more-tokens/ https://www.vesely.sk/blog/ai-needs-better-engineering-not-more-tokens/ Tue, 28 Jul 2026 00:00:00 GMT The future of AI will not be decided only by larger models or longer context windows. It will be decided by the engineering process around them: workflow, memory, rules, verification, review and evidence. AIaiai-engineeringsoftware-engineeringvibe-codingai-agentsdeveloper-productivitygovernancecybersecuritydevsecopscode-reviewaudit-evidenceverification https://www.vesely.sk/blog/every-software-has-a-bug/ https://www.vesely.sk/blog/every-software-has-a-bug/ Tue, 28 Jul 2026 00:00:00 GMT Every piece of software contains weaknesses. The real question is not whether a bug exists, but whether we find it first or an attacker does. Cybersecuritycybersecuritysoftware-securityappsecsecure-by-designvulnerability-managementdevsecopscode-reviewtestingrisk-managementincident-responsesecurity-maturity https://www.vesely.sk/blog/vibe-coding-needs-memory-skills-and-review/ https://www.vesely.sk/blog/vibe-coding-needs-memory-skills-and-review/ Mon, 27 Jul 2026 00:00:00 GMT Vibe coding is fast, but without durable memory, reusable skills, deterministic verification and independent review, AI-assisted development can quickly become chaos. AI Securityai-securityvibe-codingaiai-agentssoftware-engineeringdevsecopssoftware-architecturedeveloper-productivitygovernancecybersecurityautomationcode-review https://www.vesely.sk/blog/ai-assisted-development-needs-security-from-day-one/ https://www.vesely.sk/blog/ai-assisted-development-needs-security-from-day-one/ Wed, 22 Jul 2026 00:00:00 GMT AI makes it easier than ever to build and deploy software. That also means basic web security, AppSec and DevSecOps checks must happen before publishing, not after deployment. AI Securityai-securitycybersecurityappsecdevsecopsaiweb-securityvibe-codingsecure-by-designastrovercelcloudflaresecurity-headerscspcaa https://www.vesely.sk/blog/ai-just-changed-the-threat-model/ https://www.vesely.sk/blog/ai-just-changed-the-threat-model/ Wed, 22 Jul 2026 00:00:00 GMT Autonomous AI agents change enterprise security assumptions. The next generation of cybersecurity will be about continuously proving that infrastructure is still trustworthy. AI Securityai-securitythreat-modelingcybersecurityaizero-trustnis2cyber-resiliencecomplianceopen-sourcefiliposintegrity-monitoringaudit-evidencegovernance https://www.vesely.sk/blog/risk-management-needs-evidence-infrastructure/ https://www.vesely.sk/blog/risk-management-needs-evidence-infrastructure/ Wed, 22 Jul 2026 00:00:00 GMT NIS2, AI and modern infrastructure change risk management from a static register into a continuous evidence problem. Existing open-source tools solve parts of it, but the missing layer is proof of trust. Risk Managementrisk-managementnis2aicybersecuritygovernancecomplianceaudit-evidenceintegrity-monitoringzero-trustcyber-resilienceopen-source https://www.vesely.sk/blog/filipos-part-3-what-an-integrity-violation-really-means/ https://www.vesely.sk/blog/filipos-part-3-what-an-integrity-violation-really-means/ Sat, 18 Jul 2026 00:00:00 GMT A practical explanation of how FILIP:OS creates an integrity baseline, detects filesystem drift, classifies changes and preserves evidence without treating every difference as an attack. Projectsfiliposintegrity-monitoringcybersecurityfile-integritysha256drift-detectionlinux-securitynis2siemaudit-evidence https://www.vesely.sk/blog/compliance-is-not-a-folder-full-of-pdfs/ https://www.vesely.sk/blog/compliance-is-not-a-folder-full-of-pdfs/ Thu, 16 Jul 2026 00:00:00 GMT Real compliance is not about collecting policies and audit screenshots. It is about proving that important controls work when the business actually needs them. Compliancecompliancegovernanceauditrisk-managementcybersecurityevidenceresilience https://www.vesely.sk/blog/filipos-integrity-is-this-still-the-machine-we-installed/ https://www.vesely.sk/blog/filipos-integrity-is-this-still-the-machine-we-installed/ Thu, 16 Jul 2026 00:00:00 GMT Small Linux appliances do not become risky only when they fail. They become risky when nobody knows what changed. ProjectsFILIP:OSlinuxintegrityoperationsopen-sourceautomationinfrastructure https://www.vesely.sk/blog/ai-governance-will-define-the-next-decade/ https://www.vesely.sk/blog/ai-governance-will-define-the-next-decade/ Wed, 15 Jul 2026 00:00:00 GMT The future of AI will not be defined only by what systems can do, but by who can govern their risks, security, accountability and auditability. AIai-governancecyber-riskcybersecurityrisk-managementcomplianceauditairesponsible-aiinformation-securitydbagovernancedigital-transformation https://www.vesely.sk/blog/ai-in-hr-is-a-governance-risk/ https://www.vesely.sk/blog/ai-in-hr-is-a-governance-risk/ Wed, 15 Jul 2026 00:00:00 GMT When HR uses AI to screen, score or evaluate people, the question is not only whether it is useful, but whether it is legal, safe, fair and governed. AIaihrtechgdprai-actnis2cybersecuritygovernancerisk-management https://www.vesely.sk/blog/at-3am-preparedness-becomes-cybersecurity/ https://www.vesely.sk/blog/at-3am-preparedness-becomes-cybersecurity/ Wed, 15 Jul 2026 00:00:00 GMT A server outage at 3:00 AM reveals whether cybersecurity exists as a real operating capability, not only as documentation. Cybersecuritycybersecuritypreparednessincident-responseoperationsresilienceleadership https://www.vesely.sk/blog/companies-are-building-an-illusion-of-security/ https://www.vesely.sk/blog/companies-are-building-an-illusion-of-security/ Wed, 15 Jul 2026 00:00:00 GMT Many companies spend thousands on cybersecurity tools, audits and certificates, but still lack ownership, decision-making and a managed security system. Governancecybersecuritygovernancecompliancerisk-managementincident-responseleadershipinformation-security https://www.vesely.sk/blog/filipos-safer-operational-layer/ https://www.vesely.sk/blog/filipos-safer-operational-layer/ Wed, 15 Jul 2026 00:00:00 GMT FILIP:OS started from a simple frustration: Linux is powerful, but real operations too often become scattered scripts, manual fixes and unsafe commands. Projectsfiliposlinuxoperationsalpinesecurityautomation https://www.vesely.sk/blog/from-polymorphic-viruses-to-polymorphic-attacks/ https://www.vesely.sk/blog/from-polymorphic-viruses-to-polymorphic-attacks/ Wed, 15 Jul 2026 00:00:00 GMT In 1994, the problem was a polymorphic virus. Today, the problem is polymorphic attacks. The technology changed, but the principle stayed familiar. Cybersecuritycybersecuritymalwarepolymorphic-virusincident-responsethreat-analysisonehalfsecurity-thinking https://www.vesely.sk/blog/having-a-firewall-is-not-security/ https://www.vesely.sk/blog/having-a-firewall-is-not-security/ Wed, 15 Jul 2026 00:00:00 GMT A firewall, antivirus, backups and logs are not enough. The real question is whether information security is owned, controlled, evidenced and repeatable. Governancecybersecuritynis2gdprinformation-securityrisk-managementgovernancesecurity-maturity https://www.vesely.sk/blog/how-much-does-one-hour-of-downtime-cost/ https://www.vesely.sk/blog/how-much-does-one-hour-of-downtime-cost/ Wed, 15 Jul 2026 00:00:00 GMT Before investing in firewalls, monitoring, backups or audits, companies should understand the real business cost of one hour of downtime. Risk Managementitmonitoringcybersecuritynis2business-continuityrisk-managementnetxmsinfrastructuremanagementleadership https://www.vesely.sk/blog/it-is-the-nervous-system-of-corporate-responsibility/ https://www.vesely.sk/blog/it-is-the-nervous-system-of-corporate-responsibility/ Wed, 15 Jul 2026 00:00:00 GMT Modern IT is no longer a printer-support function. It connects legal, operational, manufacturing and cybersecurity responsibility into one risk space. Governancecybersecuritynis2gdprai-actmachinery-regulationot-securitygovernancerisk-management https://www.vesely.sk/blog/kyc-is-not-know-everything-forever/ https://www.vesely.sk/blog/kyc-is-not-know-everything-forever/ Wed, 15 Jul 2026 00:00:00 GMT AML and KYC require customer due diligence, but they are not a blank cheque for uncontrolled data collection, AI scoring and permanent profiling. Complianceamlkycgdpraicompliancerisk-managementgovernanceprivacy https://www.vesely.sk/blog/onehalf-real-cybersecurity-not-presentation/ https://www.vesely.sk/blog/onehalf-real-cybersecurity-not-presentation/ Wed, 15 Jul 2026 00:00:00 GMT In 1994, dealing with the OneHalf polymorphic virus was not about frameworks or best practices. It was about understanding the mechanism and keeping systems working. Cybersecuritycybersecurityonehalfmalwarepolymorphic-virusheuristic-analysisincident-responsesecurity-reality https://www.vesely.sk/blog/security-starts-by-admitting-you-do-not-have-it/ https://www.vesely.sk/blog/security-starts-by-admitting-you-do-not-have-it/ Wed, 15 Jul 2026 00:00:00 GMT If a company believes compliance, tools and a passed audit mean cybersecurity is under control, it may only have an illusion of security. Governancecybersecuritycompliancegovernancerisk-managementincident-responseisoleadershipinformation-security https://www.vesely.sk/blog/six-things-to-start-cybersecurity-right/ https://www.vesely.sk/blog/six-things-to-start-cybersecurity-right/ Wed, 15 Jul 2026 00:00:00 GMT If I came into a company with no real cybersecurity, I would not start by buying tools or running an audit. I would start with ownership, decisions and control. Cybersecuritycybersecuritygovernanceincident-responsepreparednessrisk-managementleadershipinformation-security https://www.vesely.sk/blog/the-biggest-incident-response-failure-is-hesitation/ https://www.vesely.sk/blog/the-biggest-incident-response-failure-is-hesitation/ Wed, 15 Jul 2026 00:00:00 GMT The worst failure I have seen during a security incident was not technology. It was hesitation, unclear authority and loss of control. Cybersecuritycybersecurityincident-responseransomwarecrisis-managementleadershiprisk-managementpreparedness