Links

Things I find useful.

A small, changing selection of sources I return to and recommend. These are here because they help me think, learn or make sense of a subject. They are starting points, not endorsements of everything a site or author publishes.

Ideas and information

FinOps Framework

A useful shared reference for connecting technology decisions, financial accountability and business value. I use it to give teams a common language for the work.

CloudZero

My favourite FinOps tool. It helps connect cloud costs to the products, teams and business context behind the spend.

NIST AI Risk Management Framework

A practical way to structure conversations about AI risk across governance, context, measurement and response. I find it helpful to bring risk into the design and operating discussion.

Artificiality Institute

A human-centred perspective on AI, looking at its effects on cognition, relationships and identity. I find it a useful companion to discussions that focus mainly on systems, controls and efficiency.

Model Context Protocol security best practices

A focused security reference for systems that connect models to tools and data. It is useful when thinking through identity, permissions, trust boundaries and what an integration can actually do.

ENISA: Cybersecurity in the Frontier AI Era

A European cybersecurity perspective on how frontier AI changes the work of defenders and public authorities. Useful for connecting AI capability with operational security.

Learn Wardley Mapping

A free, structured way into Wardley Mapping, including Simon Wardley’s book and a reference to return to while making maps. I use mapping to think about dependencies, evolution and build-versus-buy choices.

IT infrastructure

AWS Architecture Center

Reference architectures, design patterns and service guidance for building and operating workloads on AWS.

Azure Architecture Center

Solution ideas, example workloads, architecture patterns and technology decision guides for Azure.

Google Cloud Well-Architected Framework

Guidance for designing and operating secure, resilient, efficient and cost-aware Google Cloud workloads, including hybrid and multi-cloud environments.

CNCF Cloud Native Landscape guide

A guide to the cloud native ecosystem, organised by what different technologies do and how they fit together. Helpful when a long list of tools needs a little structure.

Enterprise architecture and best practices

The Open Group: TOGAF Standard

A widely used enterprise architecture method and body of guidance. A useful reference for structuring architecture work and adapting it to an organisation’s context.

Google SRE books

Practical books on reliability engineering and operating production services, including the SRE Workbook and Building Secure and Reliable Systems.

NIST Cybersecurity Framework 2.0

A flexible way for organisations to understand, prioritise and communicate cybersecurity risk, with resources for applying the framework.

DORA

Research and practical guidance on the capabilities behind software delivery and operational performance. I like its focus on the wider system that helps teams deliver well, rather than treating delivery speed as the only outcome.

A few places to start

AI-native engineering

My view of the people, platform, process and controls that need to develop together as AI becomes part of engineering work.

Digital sovereignty and the ability to change

A practical way to think about control: whether an organisation could change a critical dependency if it had to.

People I learn from

Simon Wardley

His writing on strategy and Wardley Mapping has helped me think about user needs, dependencies and how capabilities change over time. His free book is a good place to start.