Jelle De Laender

The through-line

Across these posts, Jelle De Laender keeps returning to one idea: security and compliance are only useful when they are built in from the start, not bolted on later. He applies this lens to regulation (NIS2, the AI Act, ISO 27001), to client conversations about closing B2B deals, and even, half-jokingly, to a broken office coffee machine that gets a full "incident management procedure" . Over the period covered, this preoccupation widens from process and audits into how AI is changing the threat model itself, and from professional writing into personal, physical challenges like the Dodentocht, where the same instinct for spotting things to improve shows up again, this time applied to his own side project ChaseMe .

On compliance by design

De Laender's clearest recurring argument is that compliance should be embedded rather than appended. Reacting to a podcast conversation about SaaS sales, he writes "compliance cannot be something you 'add later'" and says he believes "in compliance by design. Not as a big bureaucratic layer. Not as a separate team that slows everything" . He extends this to regulation itself, arguing that "organisations with a mature ISO 27001 ISMS get a genuine head start" on the AI Act because "both are built on the same principles: governance, risk management, accountability, and continuous improvement" . In Dutch-language commentary on a client's audit, he frames the goal the same way: not to "zo snel mogelijk een ISMS op te zetten" but to "effectief in controle te zijn," with agility coming from doing it early, before legacy and overhead build up . He also tracks the regulatory landscape closely, noting Belgium's near two-year head start on NIS2 over the Netherlands and warning that "SaaS is not the legal test" for who the law applies to .

On AI's risks

He is an unambiguous power user of AI who is nonetheless wary of how others use it. "I'm scared of AI. Not of AI itself. Not of the technology. But of how people are using it," he writes, describing himself as running through a "Claude Max plan and an OpenAI Pro 20x plan every month" while still "challenging the PRs" an AI agent produces because "the logic, the architecture or the actual solution is not always the right fit" . His concern is chiefly about context and blind trust: "Too many people are using AI blindly. Unknowingly. Without enough awareness. Without enough critical thinking" . He connects this to a concrete new attack surface, citing "Agentjacking" research where a fake Sentry bug report can get an AI coding agent to "run commands on the developer's machine," concluding that with AI agents, tools like logs and error reports "are no longer just 'data sources.' They can become instruction sources" .

On small gestures and internet plumbing

De Laender is drawn to small, low-visibility mechanisms that quietly hold things together, whether social or technical. On a "Thank developer" button in the Homey App Store for his open-source Bose-speaker app, he writes "it's a nice reminder of how much UX, feedback and a little bit of gamification can influence how a product feels," reporting "133 active installations," "18 countries," and "193 Bose speakers brought back to life" , with an earlier count of "85 Bose SoundTouch speakers" restored . He applies the same appreciation to internet-scale infrastructure, pointing out that "one of the most impactful security controls on the internet is maintained by a non-profit," noting that "around 59% of identifiable TLS certificates are issued by Let's Encrypt" and arguing "security is also about supporting the ecosystem we all depend on" . He shows the same forward-looking, practical instinct in flagging Chrome's coming HTTP warnings, telling organisations the real risk is not the main website but "an old domain, forgotten subdomain or legacy service" .

Takeaways

• Build compliance into the product and sales process from day one rather than treating it as a late add-on if you want to close larger B2B deals .
• A mature ISO 27001 ISMS gives real head start on AI Act transparency obligations because both rest on the same governance and risk-management principles .
• Watch for NIS2 exposure signals like 50+ employees or over €10 million in turnover, since "SaaS" alone is not the legal test for applicability .
• Treat AI coding agents' inputs, including logs, error reports and observability data, as potential instruction sources that can be weaponised, as shown by the Agentjacking Sentry DSN attack .
• Audit forgotten subdomains and legacy internal services before Chrome 154 starts warning users about non-HTTPS sites .
• Small UX touches, like a "Thank developer" button, can meaningfully change how users feel about a product even without new features .