About

About

Hi, I’m Subodh Patil

I’m a Principal Information Security Architect based in Stuttgart, Germany. I write about one question in many forms: who is accountable, and for what, when an enterprise runs AI and data on infrastructure it doesn’t own? That covers AI risk management and governance, cloud AI trust boundaries, the EU AI Act and Cyber Resilience Act, encryption and key management, and the post-quantum transition.

I came to security from the inside of the code: I started as a software developer (.NET, C#, enterprise applications), spent time on Microsoft’s ASP.NET / IIS / Azure Websites support team, and moved deliberately into security architecture around 2018. For the past several years I have led security architecture for a global, multi-tenant enterprise SaaS platform — cloud security, IAM, Zero Trust, compliance, and AI risk. That background is why these posts read like architecture reviews rather than policy summaries.

What I Write About

  • AI Risk & Governance — who owns and accepts AI risk; trust boundaries between cloud platforms and model providers; what ISO/IEC 42001, the NIST AI RMF and the EU AI Act actually require of a deployer or provider.
  • Cloud Security & Key Management — secure design on Azure and SaaS platforms; customer-managed keys, BYOK, BYOH and escrow models at scale.
  • Cryptography & TLS — how HTTPS and TLS really work, what auditors check, and how to plan the post-quantum migration.
  • Compliance & Data Residency — what multi-geo and data sovereignty mean for SaaS vendors and their customers.

Written for security architects, CISOs, engineering leaders and compliance practitioners who want substance over surface-level content.

Topic guides

Editorial Policy

  • Independent. This is a personal blog. No sponsorships, no affiliate links, no vendor-funded content. Opinions are my own and do not represent any employer, vendor or regulator.
  • Practitioner-sourced, non-attributable. Lessons are drawn from real enterprise work across industries, deliberately generalised. No customer, incident or program is identified or implied.
  • Sourced and dated. Posts cite primary sources (standards, regulations, vendor documentation) and carry a publication and last-modified date. Where a claim depends on a vendor’s current architecture or a regulatory timeline, the post says so and I update it when the facts change.
  • AI assistance. I may use generative AI tools to assist with research, drafting, editing, formatting, and visual illustrations. I review and fact-check each post and retain editorial responsibility for what I publish. The analysis and opinions are my own. I share this as an editorial transparency note; it is not a claim that Article 50 of the EU AI Act requires this disclosure or that disclosure alone establishes compliance.
  • Corrections welcome. If something is wrong or out of date, email me — I’d rather fix it than defend it. Material corrections are noted in the post.
  • Reuse. Everything here is licensed CC BY 4.0. Quote it, cite it, build on it — with a link back.

Credentials & Certifications

  • 🛡️ ISC2 CISSP — Certified Information Systems Security Professional
  • 🤖 ISACA AAIR — Advanced in AI Risk (May 2026)
  • 🧭 Microsoft Certified: AI Transformation Leader
  • ☁️ Microsoft Certified: Cybersecurity Architect Expert
  • 🔵 Microsoft Defender for Cloud Black Belt
  • ☁️ Azure Cloud Security Consultant

45+ certifications spanning cloud, security, and architecture. View all verified badges on Credly →

Speaking

  • Co-Speaker, DevCon 2017 Pune — Security in Azure (with Amit Andhale)
  • Pune User Group — Science and Technology track (2017–2018)

Cite or Contact

Short bio (for reuse): Subodh Patil is a Principal Information Security Architect based in Stuttgart, Germany, specialising in AI risk governance, cloud AI trust boundaries, and encryption architecture for enterprise SaaS. He holds the CISSP and ISACA’s Advanced in AI Risk (AAIR) credentials and writes at blog.suubodhpatil.com.

Every post has a “Cite this article” block with APA and BibTeX. For questions, corrections, or to discuss cloud security, architecture decisions, or AI risk: