https://falshaw.de/ Field notes on AI security, enterprise security practice and firewall engineering. en Mon, 26 Oct 2026 00:00:00 +0000 https://falshaw.de/posts/freelance-market-q3-2026-it-share.html https://falshaw.de/posts/freelance-market-q3-2026-it-share.html Mon, 26 Oct 2026 00:00:00 +0000 freelance.de Q3 2026: projects up 5.3 % on the year, but IT's share fell from 33.4 % to 28.9 %. Where the growth went, read from a firewall contractor's seat. https://falshaw.de/posts/eu-platform-work-directive-it-freelancers.html https://falshaw.de/posts/eu-platform-work-directive-it-freelancers.html Sat, 17 Oct 2026 00:00:00 +0000 The EU platform work directive must be German law by 2 December 2026 and no German draft is public yet. How IT freelancers check whether their agency counts. https://falshaw.de/posts/e-rechnung-it-freelancer-2027.html https://falshaw.de/posts/e-rechnung-it-freelancer-2027.html Thu, 15 Oct 2026 00:00:00 +0000 German e-invoicing for IT contractors: the €800,000 rule, why your December 2026 invoice is the first deadline, agency Gutschriften, timesheets and formats. https://falshaw.de/posts/nis2-supplier-clauses-freelance-contractor.html https://falshaw.de/posts/nis2-supplier-clauses-freelance-contractor.html Sun, 11 Oct 2026 00:00:00 +0000 NIS2 rarely binds a one-person contractor, but § 30 BSIG reaches you through the client's supplier annex. The five clauses, what to sign, what to push back on. https://falshaw.de/posts/nis2-late-registration-bsi-how-to.html https://falshaw.de/posts/nis2-late-registration-bsi-how-to.html Sun, 11 Oct 2026 00:00:00 +0000 Missed the 31 July NIS2 deadline? How to register with the BSI now: ELSTER certificate, portal data, the €500,000 fine and what registration leaves open. https://falshaw.de/posts/how-to-become-an-it-freelancer-germany.html https://falshaw.de/posts/how-to-become-an-it-freelancer-germany.html Sat, 10 Oct 2026 00:00:00 +0000 Going freelance in IT in Germany: Freiberufler or Gewerbe, ELSTER registration, VAT, insurance, the project list agencies expect and where to upload it. https://falshaw.de/posts/bsi-federal-it-security-self-assessment.html https://falshaw.de/posts/bsi-federal-it-security-self-assessment.html Sat, 10 Oct 2026 00:00:00 +0000 Germany's audit court: the BSI checked 15 federal bodies on site in two years. At that pace a full round would take over 20 years. A firewall contractor's view. https://falshaw.de/posts/ai-discounts-time-and-material-it-contracts.html https://falshaw.de/posts/ai-discounts-time-and-material-it-contracts.html Wed, 07 Oct 2026 00:00:00 +0000 Lünendonk IT-Sourcing-Trends 2026/2027: 70% of IT buyers negotiate discounts on time-and-material billing as AI use grows. A firewall contractor's read. https://falshaw.de/posts/freelancer-kompass-2026-projects-stall-client-side.html https://falshaw.de/posts/freelancer-kompass-2026-projects-stall-client-side.html Sun, 04 Oct 2026 00:00:00 +0000 Freelancer-Kompass 2026: 43% of freelancers had no secured work, 42% cite clients without decision authority. A firewall contractor's read on what stalls. https://falshaw.de/posts/german-spy-law-zero-day-firewall.html https://falshaw.de/posts/german-spy-law-zero-day-firewall.html Thu, 01 Oct 2026 00:00:00 +0000 Germany's intelligence reform lets the BND switch off hostile servers but sets no rule on when a known firewall hole gets reported. A contractor's read. https://falshaw.de/posts/statusfeststellung-reform-legal-certainty-pension.html https://falshaw.de/posts/statusfeststellung-reform-legal-certainty-pension.html Fri, 25 Sep 2026 00:00:00 +0000 Germany's draft offers freelancers a safe self-employed status if the client withholds 16.74% of the fee for the state pension. A security contractor's read. https://falshaw.de/posts/it-freelancer-rates-2026-experience-premium.html https://falshaw.de/posts/it-freelancer-rates-2026-experience-premium.html Sat, 19 Sep 2026 00:00:00 +0000 freelance.de 2026: German freelancers under five years bill €83.41, over twenty years €106.81. A 28% premium for two decades, read from a contractor's seat. https://falshaw.de/posts/german-consulting-market-sorting-2026.html https://falshaw.de/posts/german-consulting-market-sorting-2026.html Sun, 06 Sep 2026 00:00:00 +0000 Lünendonk 2026: German top-20 consultancies grew 4.1%, six shrank, one grew 26.4%. A 45-point spread in a flat market, read from a contractor's seat. https://falshaw.de/posts/digital-sovereignty-cloud-exit-test.html https://falshaw.de/posts/digital-sovereignty-cloud-exit-test.html Sat, 29 Aug 2026 00:00:00 +0000 85% of German firms say they are too dependent on US cloud. 71% still use it. The gap is not conviction. It is that nobody has priced or tested the exit. https://falshaw.de/posts/enterprise-ai-pilots-fail-governance.html https://falshaw.de/posts/enterprise-ai-pilots-fail-governance.html Wed, 26 Aug 2026 00:00:00 +0000 Three independent 2026 studies found 95% of enterprise AI pilots deliver no measurable return. The model is rarely the reason. Here is where they actually die. https://falshaw.de/posts/shadow-ai-employees-hiding-ai-use.html https://falshaw.de/posts/shadow-ai-employees-hiding-ai-use.html Sat, 22 Aug 2026 00:00:00 +0000 Two thirds of office staff use AI their employer never approved, and the ones hiding it understand it best. Why the policy, not the people, is the failure. https://falshaw.de/posts/ai-safety-pause-self-declared-threshold.html https://falshaw.de/posts/ai-safety-pause-self-declared-threshold.html Wed, 19 Aug 2026 00:00:00 +0000 OpenAI paused training after its own agent hacked Hugging Face, then said Astra never stopped. What a self-declared safety threshold is worth. https://falshaw.de/posts/ai-benchmark-theater-kimi-k3.html https://falshaw.de/posts/ai-benchmark-theater-kimi-k3.html Thu, 30 Jul 2026 00:00:00 +0000 Kimi K3 topped AI leaderboards while omitting a 51% hallucination rate. Why benchmark theater is compliance theater, and how to evaluate AI like an auditor. https://falshaw.de/posts/jadepuffer-autonomous-ransomware.html https://falshaw.de/posts/jadepuffer-autonomous-ransomware.html Fri, 17 Jul 2026 00:00:00 +0000 JadePuffer is the first ransomware run entirely by an AI agent, foothold to encryption, no human operator. It went from failed login to fix in 31 seconds. https://falshaw.de/posts/ai-coding-tool-was-profiling-you.html https://falshaw.de/posts/ai-coding-tool-was-profiling-you.html Mon, 13 Jul 2026 00:00:00 +0000 A researcher found Claude Code quietly fingerprinting users. The scandal is not Anthropic. It is that you gave a vendor agent root and never audited the trust. https://falshaw.de/posts/security-controls-that-fail-silently.html https://falshaw.de/posts/security-controls-that-fail-silently.html Sun, 05 Jul 2026 00:00:00 +0000 Controls that pass the audit and stop zero attacks: unread access reviews, log-only WAFs, phishing-completion metrics. Test effectiveness, not existence. https://falshaw.de/posts/credential-is-dead-continuous-verification.html https://falshaw.de/posts/credential-is-dead-continuous-verification.html Sat, 27 Jun 2026 00:00:00 +0000 16 billion credentials leaked and stolen sessions stroll past MFA. Possession stopped proving identity. The fix is continuous verification, not a stronger key. https://falshaw.de/posts/ai-agent-non-human-identity-sprawl.html https://falshaw.de/posts/ai-agent-non-human-identity-sprawl.html Sat, 27 Jun 2026 00:00:00 +0000 AI agents are non-human identities with standing access. After 17 years cleaning up orphaned firewall rules and dead service accounts, the sprawl is familiar. https://falshaw.de/posts/prompt-injection-confused-deputy.html https://falshaw.de/posts/prompt-injection-confused-deputy.html Sun, 21 Jun 2026 00:00:00 +0000 Prompt injection is a confused-deputy attack: the agent wields its authority for an attacker. Network security solved that with trust boundaries decades ago. https://falshaw.de/posts/autonomous-ai-agent-cyberattack.html https://falshaw.de/posts/autonomous-ai-agent-cyberattack.html Sat, 20 Jun 2026 00:00:00 +0000 An AI agent ran a real intrusion end to end, foothold to data exfiltration, in under an hour with no human. What the autonomous attacker breaks for defenders. https://falshaw.de/posts/authentication-bypass-network-and-ai-2026.html https://falshaw.de/posts/authentication-bypass-network-and-ai-2026.html Thu, 11 Jun 2026 00:00:00 +0000 A Check Point VPN zero-day and the BadHost flaw in Starlette are the same CWE-287 mistake: trusting attacker-controlled input to authenticate. https://falshaw.de/posts/cvss-to-asr-measuring-ai-risk.html https://falshaw.de/posts/cvss-to-asr-measuring-ai-risk.html Sun, 07 Jun 2026 00:00:00 +0000 For 17 years I scored security risk in CVSS. Anthropic just gave AI agents their own number: a 31.5% prompt-injection hijack rate. The discipline transfers. https://falshaw.de/posts/firewall-cve-ai-agent-skill-same-mistake.html https://falshaw.de/posts/firewall-cve-ai-agent-skill-same-mistake.html Wed, 03 Jun 2026 00:00:00 +0000 A root-RCE firewall CVE and a poisoned AI-agent skill marketplace share one root cause: no provenance, no least privilege, no change control. https://falshaw.de/posts/zero-trust-mittelstand-90-day-plan.html https://falshaw.de/posts/zero-trust-mittelstand-90-day-plan.html Tue, 28 Apr 2026 00:00:00 +0000 A pragmatic Zero Trust plan for the German Mittelstand: three 30-day phases for identity, segmentation, and continuous verification, built for NIS2 pressure. https://falshaw.de/posts/owasp-llm-top-10-2026.html https://falshaw.de/posts/owasp-llm-top-10-2026.html Tue, 28 Apr 2026 00:00:00 +0000 OWASP LLM Top 10 field-tested against real codebases: the 5 AI vulnerabilities most likely to break production LLM systems in 2026, and what holds up in review. https://falshaw.de/posts/mittelstand-nis2-german-smes-dangerously-unprepared.html https://falshaw.de/posts/mittelstand-nis2-german-smes-dangerously-unprepared.html Wed, 04 Feb 2026 00:00:00 +0000 A EUR50M Mittelstand champion often runs security on a 3-person IT team. Why German SMEs are dangerously unprepared for NIS2 deadlines, and what to fix first. https://falshaw.de/posts/7-lessons-enterprise-security-compliance.html https://falshaw.de/posts/7-lessons-enterprise-security-compliance.html Wed, 04 Feb 2026 00:00:00 +0000 A Palo Alto SOC failed its audit; a rival on basic firewalls passed. 10 lessons from 17 years of enterprise security compliance: documentation wins. https://falshaw.de/posts/ai-threat-detection.html https://falshaw.de/posts/ai-threat-detection.html Thu, 29 Jan 2026 00:00:00 +0000 AI threat detection for CISOs: 7 practical strategies for reducing alert noise, finding novel attacker behaviour, and proving detection maturity.