Lessons

The concrete patterns that separate an automation that works from one that keeps working: validating input at the boundary, retrying only what is safe to retry, handling rate limits and batches, testing something you cannot easily test, and keeping secrets out of the flow.

No-code automation makes building easy and running reliably hard. This lesson covers what these platforms actually are, the failure modes that appear once something runs unattended, why partial failure is worse than total failure, and the idempotency problem behind most real damage.

Longer sessions have their own failure modes: energy, structure over hours, and the gap between a productive day and anything changing afterwards. This lesson covers designing a workshop backwards from its output, running a retrospective people tell the truth in, and why most session outcomes evaporate.

Facilitation is mostly managing who speaks and who does not. This lesson covers why the loudest voice dominates for structural reasons, techniques that redistribute airtime without confrontation, handling the person who derails, and what to do when a group agrees too easily.

A meeting is a decision about how to spend the combined attention of everyone in the room. This lesson covers the four things meetings are actually for, why mixing them fails, who should be present, and the preparation that determines whether the hour is worth what it costs.

Delegating cognitive work has effects on the delegator. This lesson covers cognitive offloading and what is known about it, why the tasks that feel wasteful are often where skill is built, the expertise paradox in who benefits, and how to decide what to keep doing yourself.

Verification is now the expensive step, which changes what a sensible checking strategy looks like. This lesson covers the asymmetry between producing and refuting, deciding what to check before you read it, the questions that actually discriminate, and what a citation is worth.

Generated output is persuasive through properties unrelated to whether it is true. This lesson covers processing fluency, automation bias, the illusion of explanatory depth, and sycophancy: four mechanisms that make a confident draft harder to evaluate than a hesitant colleague.

QKD has an unconditional security proof and almost no deployment. This lesson covers the authentication bootstrap it cannot solve, distance limits and the trusted node compromise, attacks on real hardware that the proof does not cover, why NSA and NCSC recommend against it, and where quantum genuinely delivers.

Quantum cryptography uses physics rather than computational hardness. This lesson covers the no-cloning theorem, the BB84 protocol step by step, why measurement in the wrong basis leaves a detectable trace, the error rate threshold, and the entanglement-based alternative.

A correct system nobody uses has failed. This lesson covers why adoption fails for reasons unrelated to quality, writing documents senior people actually read, managing expectations set by AI hype, working with domain experts rather than around them, and building the credibility that gets you consulted early.

Technical work is probabilistic and stakeholders want guarantees. This lesson covers communicating error rates in terms people can act on, why the two kinds of mistake are not interchangeable, setting expectations before deployment rather than after, and saying no to a request that will not work.

Technical people explain badly for specific, fixable reasons rather than through lack of effort. This lesson covers the curse of knowledge, why answering the question asked is often wrong, what stakeholders are really asking underneath, and the register problem that makes accuracy and clarity feel opposed.

The practical middle ground: knowing what data you actually have and reducing it, securing devices and home working without a device management budget, and answering the security questionnaires customers increasingly send to their small suppliers.

Ransomware is the incident that closes small businesses. This lesson covers how it actually unfolds, the decisions that get made badly under pressure, whether to pay, what the first day looks like, and the preparation that turns a business-ending event into a bad week.

Small businesses are told to do everything and can afford almost nothing. This lesson identifies what small organisations are actually attacked with, why that differs from what security marketing describes, and the small set of controls that removes most of the realistic risk.

The other direction of the problem. Employees using AI tools create exposure through data leaving the organisation, prompt injection turning an assistant against its user, malicious extensions, and code suggestions nobody verified. This lesson covers what to worry about and what is overstated.

If recognition no longer establishes identity, verification has to move to the channel. This lesson builds the practice: out-of-band confirmation, which requests need it, designing protocols people will actually follow under pressure, the household version, and what to do in the first hour after something goes wrong.

Security awareness training taught people to spot bad grammar, odd domains and generic greetings. Those signals are gone. This lesson covers what generative tools changed about attacks, what they did not change, and why detection-based defence was always the weaker half.

Almost every business question reduces to one of a small number of analytical shapes. This lesson covers trend, breakdown, funnel, cohort and distribution, what each is good for, how each misleads, and what you may and may not conclude from any of them.

The handful of spreadsheet techniques that cover most business analysis, and the specific ways they fail silently. Covers pivot tables, lookups and what a join actually does, structuring data so tools can use it, and the errors that produce plausible wrong answers.

Most analysis fails at the start, on a question too vague to answer or one the data cannot address. This lesson covers turning a business question into a measurable one, what your data was actually collected for, and the checks that come before any calculation.

A correct analysis presented badly changes nothing, and a correct analysis that threatens someone gets attacked on its method. This lesson covers reading the audience, socialising findings before the meeting, handling challenge, delivering unwelcome results, and where persuasion becomes manipulation.

Chart choice is not aesthetic, it follows from the comparison you want the audience to make. This lesson maps question types to chart types, covers the encodings people read accurately, and works through the design choices that mislead, including the ones that mislead accidentally.