Updates, insights, and commentary from the OSA community. Tracking the evolution of security architecture since 2008.
OSA's control catalogue now follows NIST SP 800-53 Release 5.2.0 control for control, and it carries the control enhancements too. All 300 controls read as NIST publishes them, and each one lists its enhancements, 714 in all, with the baselines that include them. The catalogue is generated from NIST's own files, so it stays in step.
AI agents and crawlers are now a large part of the traffic to Open Security Architecture, in line with what Cloudflare has reported across the web. This week we tuned the site for them and measured the results. Agents now use around half the tokens to answer a typical question from OSA, and a single page read gives the right answer 10 times out of 10 in our tests.
OSA has added two new definition pages -- [IT Security Architecture](/definitions/it-security-architecture) and [IT Risk](/definitions/it-risk) -- that establish the shared vocabulary underpinning the pattern library, Capability Model, and Assessment tool.
The Foundations section of OSA has undergone a significant structural redesign. This post documents the decisions made, the rationale behind them, and the resulting changes.
The security architecture for blockchain and distributed ledger technology has matured past the point where it can be treated as a single problem. Tokenised assets, decentralised identity, zero-knowledge proofs, and central bank digital currencies are distinct architectural domains with distinct threat models, distinct regulatory regimes, and distinct control requirements. Treating them as variations of "blockchain security" is like treating API security and network segmentation as variations of "internet security" -- technically not wrong, but not useful for anyone who has to build the thing.
When we published SP-027 in early February, it was OSA's first new security pattern in over a decade. It addressed a genuine gap: how to securely integrate AI agents into enterprise environments.
The NCSC published a call for research partners this week as part of their Active Cyber Defence 2.0 programme. The focus: External Attack Surface Management. Ollie Whitehouse, the NCSC's CTO, described it as helping organisations understand their internet-facing exposure -- a problem that feels like it should be solved by now but is more nuanced than it appears.
Cloudflare announced Markdown for Agents this week -- a feature that converts HTML pages to markdown on the fly when an AI agent requests them. It is a smart solution to a real problem: AI agents waste tokens parsing HTML when they just need the content. Claude Code, OpenCode, and other coding agents already send `Accept: text/markdown` in their request headers, and Cloudflare intercepts that to serve clean markdown instead of raw HTML.
If you are a security architect, GRC manager, or compliance lead, you have almost certainly maintained a spreadsheet that maps controls from one framework to another. You have sat in meetings where someone asks which ISO 27001 clauses are satisfied by the NIST controls you have already implemented. You have spent days preparing evidence for an auditor who needs to see the same controls through the lens of a different framework.
Every security team I have worked with over the past twenty years has had the same problem. They can tell you which controls they have implemented. They can show you compliance dashboards, maturity scores, and audit findings. What they cannot do is answer the one question the board actually cares about: how much risk are we carrying, in money?