Nerdy Stuff. Tech Talk. Zero Freshness.
Analysis and commentary on GRC, security, and AI. Essays for operators and leaders who are tired of decorative governance, vendor theater, and fresh takes that were already stale on arrival.
These are not the newest pieces. They are the ones that explain the publication fastest: one argument about security theater, one about compliance theater, and one about AI governance theater.
Security
GRC
AI
If you are new to the site, start with one strong essay per beat and follow the argument from there.
GRC
Start with the pieces that explain how governance theater forms, then move into the essays that show where evidence, ownership, and control design actually break.
The cleanest entry point into the site’s anti-ceremony stance on compliance and control programs.
Open GRC guideSecurity
Read these if you want the site’s core security argument: most programs do not fail at tooling first. They fail at ownership, inventory, identity context, and operational clarity.
A foundational Spoiledlunch essay on what happens when architectural slogans meet real estates.
Open Security guideAI
Start here if you want the site’s consistent AI position: governance becomes real only once the system is deployed, observed, and capable of being challenged under live conditions.
The clearest statement of what Spoiledlunch rejects in enterprise AI governance.
Open AI guideSummary: The Securities and Exchange Commission today proposed the rescission of overly burdensome and costly rules that require …
Summary: Boston Children’s Hospital uses OpenAI technology to improve patient care, reduce operational burden, and help diagnose …
Summary: CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active …
Summary: How Braintrust engineers use Codex with GPT-5.5 to run experiments and code faster. Why it matters: This matters if it …
Summary: OpenAI shares guidance on third-party AI evaluations, covering how to assess model capabilities, safeguards, and validity …
Spoiledlunch publishes on purpose, not on a drip campaign. If you want every essay and briefing without surrendering your inbox, use the feed.
New to RSS? Learn how to get started with feed readers.
Different domains, same standard: name the failure mode, cut through the slogans, and stay close to operational reality.
Topic 01
Governance and compliance coverage for readers who are tired of decorative control programs and evidence that proves nothing.
Explore GRC
Topic 02
Security analysis that starts with ownership, exposure, and operational clarity instead of buying another dashboard.
Explore SecurityTopic 03
AI coverage for people who care more about deployed behavior, telemetry, and intervention than framework theater.
Explore AI