<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"><channel>
<title>Breakwater Blog</title>
<link>https://www.bwtr.ai/blog/</link>
<description>Evidence-led analysis on IoT and OT security, application security, AI-governed response, and post-quantum readiness — from the team building Breakwater.</description>
<language>en-us</language>
<item><title>Why Attack Path Beats a Vulnerability List</title><link>https://www.bwtr.ai/blog/attack-path-beats-vulnerability-list/</link><guid>https://www.bwtr.ai/blog/attack-path-beats-vulnerability-list/</guid><pubDate>Tue, 29 Sep 2026 00:00:00 GMT</pubDate><description>A scanner can tell you a thousand things are wrong. It can't tell you which one matters. Attack path analysis closes that gap, and it's the difference between hygiene and a decision.</description></item>
<item><title>The Case for a Skeptic: Governing AI Response</title><link>https://www.bwtr.ai/blog/ai-governance-skeptic-in-soar/</link><guid>https://www.bwtr.ai/blog/ai-governance-skeptic-in-soar/</guid><pubDate>Tue, 22 Sep 2026 00:00:00 GMT</pubDate><description>Autonomous response is only as trustworthy as the disagreement built into it. Here's why we gave Breakwater Response a role whose entire job is to argue the incident isn't real.</description></item>
<item><title>Post-Quantum Readiness Starts with a CBOM, Not a Deadline</title><link>https://www.bwtr.ai/blog/post-quantum-readiness-cbom/</link><guid>https://www.bwtr.ai/blog/post-quantum-readiness-cbom/</guid><pubDate>Tue, 15 Sep 2026 00:00:00 GMT</pubDate><description>Most PQC conversations start with a regulatory date and end with panic. The more useful starting point is an honest inventory: what's actually using classical public-key crypto, and where.</description></item>
</channel></rss>