Articles
Long-form writing on tech, culture, and the edges of the internet.
Engineering teams keep granting agents production database writes
AI agent vulnerabilities are systems engineering failures, not security failures. The fix is architectural containment, not better prompts or guardrails.
Itron's 8-K names an IT intrusion
Itron disclosed an internal IT breach. Technical analysis of attack vectors, supply chain blast radius, and what utility defenders should assume.
Kuwait put a listening post in your pocket
Kuwait's mandated cybersecurity app is not a privacy issue. It is surveillance architecture that relocates the identity boundary inside the device.
Lagos published guidelines, not controls
Lagos cybersecurity guidelines describe intent, not enforcement. An operator analysis of why policy without system-level controls does not stop attackers.
License audit caught a six-week account takeover
A six-week account takeover surfaced in a license audit that never checked access legitimacy. Why that gap is a control failure, not a breach.
Pick offense or defense
Two paths into infosec - offense and defense - broken down at the mechanism level. Foundation, tooling, telemetry, and the divergence point.
The helpdesk chat window is the breach
Microsoft Teams helpdesk impersonation succeeds because identity verification is placed at the channel boundary, not at the credential action.
The power adapter was the attack
A WiFi camera concealed in a hotel power adapter transmitted to a foreign server. The boundary failed at the physical layer.
Your CAC has never checked who you are
A CAC verifies a certificate's cryptographic validity, not the person holding it. How trust delegation and assumption drift open the gap in DoD PKI.
Your password manager was the attacker
The Bitwarden CLI compromise inside the Checkmarx supply chain campaign is an identity and access incident. Treat the affected window as untrusted.
Your security scanner is the breach.
Cisco source code stolen, AWS keys breached, 300 repositories cloned. The exfiltration channel was Trivy operating inside Cisco's CI pipeline.
1,300 SharePoint servers speaking for someone else
Over 1,300 SharePoint servers expose a spoofing primitive where authentication and identity validation collapse into a single unenforced control.