Technology decisions are business decisions, and increasingly policy decisions. Mohd Atasha works where the three meet.

Advisors tend to come from one of these three. Having been accountable in each is less common, and it is usually why a conversation starts here.

In practice the three rarely stay apart. A regulator’s question about an artificial intelligence system arrives with a commercial deadline attached. An investment decision turns on whether the technology can in fact be delivered. Founders and investors tend to ask the same questions from the other direction.

Much of the work is strategy and commercial judgement, which does not reduce neatly to a list. The requests that arrive already shaped tend to concern risk, and those take four familiar forms.

Most organisations meet this as four separate budget lines: a security team worried about exposure, a compliance team asked how an artificial intelligence system decides, a finance team unable to explain a cloud bill, and a programme team mid-migration. They are usually treated as four problems, by four suppliers.

They are one event. A boundary that used to hold has dissolved, and the institution has taken on risk it cannot yet measure. Which is why they recur: fixing any one of them separately leaves the cause in place.

The air gap is eroding; networks built never to touch the internet now do. The datacentre perimeter dissolved into cloud and took cost visibility with it. The deterministic system gave way to models whose decisions resist the old kinds of audit. Transformation is the deliberate act of moving a boundary and hoping the consequences were understood.

Assessing that gap is the work. In one of the four it goes further: the air gap can be given back. Its value was never the wall but the silence behind it: a scan that found nothing, because nothing was listening. Arrange access so the protected machine reaches outward and never waits for a connection, and that silence returns without the isolation. That is air-gap zero trust network access, and it is the practical half of the first doctrine.