Industry insight
Written by the people who do the work
These articles are written by our engineers, not a marketing team. We avoid predictions and sales language, and we only quote figures we can source. Each article takes one question we are often asked and answers it properly.
Built to work, or built to be run
A system that works and a system that can be run properly are different things. The difference is invisible on the first day, but it becomes expensive for years afterwards.
18 June 2026 · 6 min read · Lorendix engineering team
Read the article
Your help desk is now your security perimeter
One of the most damaging UK retail breaches of the past two years started with a phone call to an outsourced IT service desk. It is now easier for attackers to talk their way through account recovery than to break the systems it protects, and most organisations have not tightened that process.
The packages you trust are now the ones attackers target
In 2026, attackers stopped relying on fake lookalike packages and started taking over genuine, widely used ones. Axios was compromised in March, and in August a self-spreading worm infected hundreds of npm packages. Every dependency you install is now a possible route into your systems.
AI agents act on what they read
AI agents are now connected to code repositories, inboxes and business tools. The security incidents so far share a common cause: an agent treated text it read as an instruction, and it had the permissions to act on it.
The EU AI Act delay is not a reprieve
The EU has postponed its rules for high-risk AI systems to December 2027. However, the transparency rules took effect as planned in August 2026, and the rules for general-purpose AI already apply. Organisations that pause their preparations now will find it harder later.
AI writes code faster, but who checks it?
AI coding assistants have shifted the bottleneck in software development from writing code to reviewing it. They also introduce new risks, including recommending software packages that do not exist until an attacker creates them.
Why AI fails on poorly managed data
A confident answer based on records that do not agree is worse than no answer, because people act on it. This article explains what needs to be in place before an AI project is safe to start.
The questions buyers now ask before they sign
Security questionnaires have changed from procurement paperwork into a condition of winning the deal. This article covers what buyers ask, and what a good answer looks like when the evidence already exists.
Bring us the question your team is stuck on
Many of these articles began as a question a client asked us. If your question is not covered here, ask us directly.