The map I work from
Two technologies are arriving on very different timelines, and both land in the same place: the infrastructure an organization already depends on. This is the territory as I actually work it — what each field is made of, and the point at which an outside specialist earns their fee.
Applied artificial intelligence
Almost every organization can now buy a model. Very few can say what it is allowed to touch, where its answers come from, or what happens when it is wrong. Those three questions are the whole job, and they are infrastructure questions before they are AI questions.
-
Foundations
AdvisoryWhat the machine is actually doing, stated plainly enough to make decisions on. Without this, every later choice is guesswork dressed as strategy.
- Tokens & context windows
- Training vs inference
- Why models hallucinate
- Prompting as specification
- Evaluating an answer
-
Knowledge & retrieval
DesignMaking a model answer from your facts rather than its memory. This is the pattern behind almost every serious enterprise assistant — including the one on this site.
- Retrieval-augmented generation
- Chunking & embeddings
- Vector stores
- Source attribution
- Data governance & residency
-
Agentic systems
DeliverySoftware that plans, calls tools and completes work. The frontier, and the point where AI stops being a text problem and becomes a security-engineering problem.
- Tool calling & function schemas
- Orchestration & task decomposition
- Guardrails & sandboxing
- Human-in-the-loop checkpoints
- Failure containment & rollback
-
Enterprise adoption
EnablementEverything that decides whether a working pilot survives contact with a real organization: who it authenticates as, what it costs, and who is accountable when it errs.
- Identity & least privilege
- Observability & audit trails
- Cost & capacity control
- Vendor & model selection
- Change management & training
Field note: in the programmes we run at Kohan System Farda, the people who advance fastest are rarely the most technical. They are the ones who kept a daily log of what worked and what failed — and an agent is only ever as trustworthy as the infrastructure underneath it.
Quantum readiness
Nothing here depends on owning a quantum computer. It depends on one question a board can answer today: how long must this data stay secret? Anything sensitive beyond 2030 already needs a plan, because the data being stolen now can be decrypted later.
-
Fundamentals
AdvisoryThe honest state of the hardware, without the popular-science mystique. A quantum computer is fast at a narrow class of problems, and slow to arrive — both halves matter.
- Qubits & superposition
- Entanglement
- Error correction as the bottleneck
- Reading qubit-count claims
- Where advantage is real
-
The threat model
AssessmentWhy a security professional cannot postpone this. Encrypted traffic captured today can be stored and opened once the hardware matures — the risk is set by your data's lifetime, not by the vendor's roadmap.
- Harvest now, decrypt later
- RSA & Diffie-Hellman
- Elliptic-curve exposure
- What survives: AES-256, SHA-2
- Data-lifetime analysis
-
Post-quantum cryptography
DesignThe replacements are standardized, not theoretical. NIST has published them; the work now is choosing correctly and deploying without breaking what already runs.
- ML-KEM for key exchange
- ML-DSA for signatures
- SLH-DSA as a conservative fallback
- Hybrid classical + PQC modes
- Certificate & TLS impact
-
Migration programme
DeliveryTurning a standard into a plan with dates. Most organizations cannot answer where their cryptography lives, and that inventory is the first deliverable, not the last.
- Cryptographic inventory
- Crypto-agility by design
- Vendor migration roadmaps
- Prioritizing by data lifetime
- Pilot, rollout & verification
Field note: when I audit infrastructure I now ask one added question — how long must this data stay secret? It reframes the conversation from a physics debate the board cannot settle into a records-retention decision it already knows how to make.
How I work with organizations
Assess
A short, evidence-based read of where you stand: what AI is already in use unofficially, where cryptography lives, and which data has a lifetime long enough to matter.
Design
An architecture your team can build and defend — retrieval and permissions for AI, crypto-agility for the quantum side — sized to the organization you actually have.
Enable
Handover that outlasts the engagement: your people trained, the decisions written down, and a roadmap with dates rather than intentions.
If one branch of either tree is a live question for your organization, that is a good place to start the conversation.