Nobody had declared where the cryptography was
Three records this morning were inferred rather than kept: a cryptographic inventory read out of source code, an exposure picture assembled from systems nobody fully understands, and a graduate displacement the microdata cannot find.
How we Organise
The graduate unemployment rate did not move this summer
Fairlie and Wu took Current Population Survey microdata for June, July and August 2026. Those are the months when recent-graduate unemployment runs highest. They went looking for the effect everyone has spent a year describing. Recent college graduates were no more likely to be unemployed than in earlier summers, and no worse off than older graduates or young workers without a degree. Widening the measure to count people who say they want a job adds nearly two percentage points to the level. The rise is still not significant.
We tell clients that the first rung of a job is where seniors come from. Hand it to a machine and the firm stops producing the people who will run it in ten years.
Automating the entry-level work removes the path that produces seniors.
The best measurement of entry-level outcomes so far does not show that rung going. An earlier study pointed the other way, on fourteen interviews in South Korea, and described tasks being absorbed upward. Fourteen interviews and a national sample are not the same weight of evidence. A household survey also cannot see what a junior does once hired, and a graduate who settles for a worse job counts as employed. If you think the displacement is real and invisible to an unemployment rate, tell us where you would look: transform@dromologue.ai.
How we Build
The cryptography was written down nowhere, so a model went and found it
Cloudflare wants full post-quantum readiness by 2029. It could not say where its cryptography was. Searching for algorithm names overcounts, because it finds code nothing calls. It undercounts too, because algorithms sit in protocol defaults and in configuration far from the code using them. So Cloudflare built CryptoLabe. A model reads the code, works out how each operation behaves at runtime, and returns unknown rather than guessing.
Our position is that a firm should work out what depends on what from the records it already keeps. Maintaining a second list by hand is the thing to avoid.
The dependency graph is derived from what the firm’s registers declare rather than maintained beside them, and carries the blast radius of a change, the order things must be upgraded in, and the firm’s concentration on any one component.
Cloudflare derived it and produced the upgrade ordering. It had no registers to derive any of it from. The declarations the practice assumes did not exist, so the derivation came from source, documentation and ticketing. Cloudflare also says no ground-truth dataset exists yet for the prompt versions it has tried. The inventory is reviewed by engineers rather than scored. Write to transform@dromologue.ai if you know how to measure a derived inventory.
How we Assure
An edge appliance was entered before anyone logged in
Mandiant found CVE-2026-88772 being exploited in Citrix NetScaler appliances since early September, across five sectors in North America and Europe. The exploit bypasses authentication and reaches root on the host underneath. A Python tunneller then proxied traffic inward. In at least one intrusion the actor took credentials by hand.
We judge a firm’s exposure at the level of the whole enterprise. Appliance by appliance is the wrong unit.
The enterprise’s exposure is stated as one thing rather than as fifty approvals.
The appliance was the door and not the room. Patching it leaves the stolen credentials behind. That is why the remediation guidance runs longer than the update. Most firms cannot assemble that picture anyway. The Bank of England and the Financial Conduct Authority found 46 per cent of 118 UK financial firms reporting only partial understanding of the AI they run. They put it down to third-party models.