What we learn running cloud, AI and security for clients, written down so you can use it without hiring us.
Most teams pick a vector store from a benchmark chart and then discover the thing that hurts is metadata filtering, tenancy or reindexing. If you already run PostgreSQL, pgvector is usually the right answer for longer than people expect.
The choice is not about features. It is about whether you are multi-cloud, whether you need short-lived database credentials, and how much operational load your team can carry.
California set the template and a growing list of states copied it with variations. What differs from GDPR, why the browser opt-out signal is the part teams miss, and how to build once for a list that keeps growing.
A cloud bill growing with revenue is fine. One growing faster is a business problem hiding inside an infrastructure report. Pick the unit, attribute the shared cost, and the conversation with the board changes.
Formatting and validation are free, static analysis is nearly free, policy on the plan is cheap, and real apply-and-destroy tests are expensive and slow. Spend accordingly, and know what each layer cannot catch.
The two failures are a module that wraps one resource and adds nothing, and a module that does everything and nobody dares change. A minimal interface, safe defaults and honest versioning are what separate them.
A StatefulSet guarantees less than people assume, a volume pins a pod to a zone, and the honest question is whether that database belongs in the cluster at all.
Most service level objectives are picked from the metric the team already had, and never change anyone's behaviour. Here is how to choose the indicator from the user's experience and wire an error budget to a real decision.
A plan is a thousand lines of diff in a terminal. The questions you actually want answered — what does this cost, what does it expose, what breaks if it fails — are not in that format. Here is how we made Skyline answer them from the code alone.
Most inventory tools ask for read-only access and trust you got it right. We made Skyline prove it first, because the ReadOnlyAccess policy a team hands you is very often not what they think it is.
Most teams running two or more clouds have never seen them on one page. When they do, the surprises are consistent enough to list: regions nobody chose, resources Terraform does not know about, and a cost distribution that does not match anyone's mental model.
Mutual TLS, fine-grained traffic control and uniform telemetry without touching application code. What each one actually costs in latency, memory and operational load, and the cheaper things that cover two out of three.
The choice is not about elegance. It is traffic shape, cold start tolerance, execution duration, environment control and what your team can actually operate at three in the morning.
The cost per token looks obviously cheaper until you account for utilisation. GPUs bill by the hour whether or not anyone is asking questions, and that single fact decides most of these decisions.
Rotation fails when the application reads the secret once at startup. Two valid credentials during the change window, an inventory that is real, and deletion instead of rotation for the credentials that should not exist at all.
Most teams have backups and no idea how long a restore takes. Set recovery targets per service, prove them with a quarterly restore test, and write the plan so it fits on one page.
One distributes work and forgets it. The other is an ordered log several consumers can replay. Choosing the wrong one produces an architecture that fights you for years.
Loops, types and tests come free with a general-purpose language. What you give up is a plan a non-programmer can review, and a low floor for the people who have to maintain it at three in the morning.
Any agent that reads untrusted content and can act will eventually take instructions from that content. The defences that work are architectural, not textual.
Cardinality is behind almost every Prometheus problem you will have, and it is usually one label added by one well-meaning engineer. How to find it, how to survive retention and HA, and when Thanos or Mimir is actually justified.
Nearly every performance incident we investigate is a missing index, a connection pool that is not there, or autovacuum sized for a database a tenth the size. Resizing the instance is the fix people try first and it is almost never the answer.
Most questions during an incident or an audit are inventory questions, and most organisations answer them with a spreadsheet. A SQL interface over live endpoint state answers them in seconds, and the scheduling is where it goes wrong.
The licence change matters differently to an end user, a software vendor and a consultancy. Compatibility is high and diverging, migration is cheap and returning is not. Here is the decision framework without the partisanship.
OpenTelemetry is not equally mature across traces, metrics and logs, and the adoption plans that fail treat it as one migration. Here is the order that works and where the double-billing months come from.
Allocation by requests or by usage creates opposite incentives, shared costs start the argument, and showback before chargeback is what stops the whole exercise being rejected.
Compartments and defined tags are the allocation model, flexible shapes make rightsizing continuous rather than stepwise, and the universal credit commitment behaves differently from a reservation.
Cold, warm and hot standby differ by an order of magnitude in price and by minutes or hours in recovery. Pick the tier from what an outage actually costs you, and be honest that most estates should buy multi-zone instead.
A scanner says a host is probably vulnerable. Controlled exploitation in an authorised engagement turns "probably" into "here is what an attacker gets", which is the difference between a finding people fix and one they file.
Log volume rises with traffic, with every new service and with every debugging session somebody forgot to turn off. Structure decides whether they are useful, and six rules decide whether they are affordable.
A classifier on every request costs time and money on every request. What to check on input, what to check on output, and how to decide whether the guardrail is worth what it takes.
A hundred real cases, per-task metrics instead of one score, and a judge calibrated against human labels. That is enough to catch regressions and to decide whether a model change is safe.
Open table formats changed the negotiation by separating storage from compute. What is left to decide is your workload mix, your governance boundary, and which cost model you can actually control.
Kyverno or Gatekeeper is a smaller decision than how you roll policy out. Audit, then warn, then enforce, with system namespaces excluded and a failure policy you have thought about.
Every Kubernetes benchmark scan produces hundreds of findings and the same handful matter. Here is which ones, why the control plane checks mostly do not apply on managed clusters, and how to stop the report being ignored.
A namespace is a naming boundary, not a security boundary. Quotas, default-deny network policy, workload identity and a clear answer on node isolation are what make a shared cluster work.
The support calendar decides your schedule whether you plan or not. Deprecated APIs, blocked drains and add-ons that lag the control plane are the three things that turn an upgrade into an incident.
Most companies running Jenkins are not running it badly, they are running it unattended. How to tell a Jenkins worth keeping from one that is quietly costing you a day a week, and what migration actually costs.
It is not a certification of your model. It is the scaffolding that makes AI governance repeatable, and if you already run ISO 27001, most of the machinery is built.
Infracost turns a Terraform plan into a monthly delta on the pull request. What it estimates well, what it cannot estimate at all, and how to keep the comment from becoming wallpaper.
Severity defined by criteria instead of instinct, three roles, one timeline and a named person who decides whether to notify. Everything else in an incident process is optional.
An approval step is the cheapest safety control and the easiest one to place badly. Put it too early and you have automated nothing; too late and you are rubber-stamping. Four placements and when each is right.
The business associate agreement is the easy part. Which services you may use, which data you can avoid holding, and the six technical safeguards that turn into actual configuration.
The auditor does not read your privacy policy. They ask which system holds personal data, how long it keeps it, who can read it and what happens when someone asks for a copy. Those are engineering questions.
An exclusion filter at the sink is the highest-return control in the whole platform, and the storage class minimums punish a lifecycle rule written without reading them.
Standard bills for nodes you provision, Autopilot bills for pod resources you request. Both are dominated by the same number, and it is the gap between what pods ask for and what they use.
Gateway API is usually sold on features. The real reason to move is that Ingress has no separation between the team that owns the load balancer and the team that owns the route. Here is the migration that does not need a maintenance window.
Every provider names, groups and dates its billing data differently, so multi-cloud cost reporting turns into a translation project. An open specification fixes the schema, and what it cannot fix is worth knowing before you build.
Fine-tuning teaches behaviour and format. Retrieval supplies knowledge. Prompting shapes the immediate task. Most teams reach for the expensive one to fix a problem it cannot fix.
They look like neighbours and they are not. One is an attestation you commission, the other is an authorisation you earn against a prescribed control baseline, and the cost difference is an order of magnitude.
Image scanning finds known vulnerabilities before deployment. Runtime detection catches the shell that spawned inside a running pod at three in the morning. The default rules are noisy and tuning them is the entire project.
Getting secrets out of manifests means an operator that syncs from your cloud's vault, a driver that mounts them, or both. The part that decides which is what your application does when the value changes.
Transfer mechanisms, region choice and support access are three different questions that get merged into one. How to answer a European buyer's questionnaire with facts rather than assurances.
If you sell software or connected hardware into the EU, security stops being a quality attribute and becomes a market access requirement, with a vulnerability reporting clock and a support period you must declare.
Most teams either assume the AI Act does not touch them or assume it bans what they are building. How to establish your role and risk tier, and what the obligations cost an engineering team.
Most tracing deployments produce disconnected single spans and a bill. Context propagation, tail sampling and a handful of useful attributes are what turn a trace store into the tool you open during an incident.
Sigma is a vendor-neutral format for detection logic that compiles to your platform's query language. The format is the easy part. Version control, testing and a lifecycle for rules are what make detection work.
A pipeline runs when someone triggers it. A controller reconciles continuously, which fixes drift by construction. What you pay is another control plane to operate and a harder debugging story.
A budget does not stop spending and a forecast alert arrives late. What actually catches a cost spike is a short detection window, a small set of known failure shapes and a named owner.
Teams upgrade the generation model to fix a retrieval problem. The chunk boundaries, what context travels with each chunk, the embedding model and a reranker account for most of the quality gap.
Chaos engineering fails when it starts with a tool and a production cluster. Start with a hypothesis, a small blast radius and a stop condition, and the first five experiments will find something every time.
Invalidation, stampede and the day the cache fills are the three. A time to live is the boring correct answer to the first, and most caching problems turn out to be a missing index.
Ransomware crews go for the backups first, and cloud backups are easier to delete than tape ever was. Immutability, credential separation and a copy outside the blast radius are what turn a backup into a recovery.
Backstage solves three real problems: finding who owns a service, creating one with the right scaffolding, and keeping docs near the code. It fails when the catalogue is maintained by hand.
Storage looks cheap per gigabyte, so nobody audits it. Then redundancy, transactions, early-deletion penalties and cross-region transfer turn a small line into a large one.
Log Analytics ingestion is the line that grows without anyone deciding it should. Six controls bring it down, and none of them mean losing the telemetry you actually use.
The AKS control plane is nearly free, so everything you pay comes from node pools, and the defaults are expensive. Here is what we change, in the order that finds money fastest.
S3 looks like a per-gigabyte price and it is not. Minimum durations, per-object overheads, transition requests and the transfer boundaries around the bucket are where the money actually goes.
Ingestion, storage, custom metrics, dashboards and queries are priced separately. The dimension explosion in custom metrics and debug logging left on in production account for most of the surprise.
Commitments lock in whatever you are running today. Before you sign one, walk the bill layer by layer and remove what should not be there. Here is the order we use.
A rule that has never fired is either excellent or broken, and you cannot tell from the outside. Adversary emulation runs the technique deliberately, in a controlled way, so that the answer stops being a guess.
An on-call rota that gets 40 pages a week is not monitoring, it is a filter that trains humans to dismiss things. Alert on symptoms, alert on burn rate, and delete everything nobody has ever acted on.
Airflow should schedule and coordinate, never process. dbt should transform inside the warehouse with tests attached. The failure that costs most is data quality nobody checked until a dashboard was wrong for a quarter.
The three changes that turn a hand-configured Jenkins into one you can rebuild from an empty machine in twenty minutes, and what each one costs to adopt.
Most multi-account designs fail because nobody agreed what an account is for. Here is the account map we deploy, what lives in each one, and the three guardrails that make it hold.
Traditional monitoring tells you the workflow succeeded. With a model in the middle, succeeding and being right are different things. What to capture, and the three dashboards worth building.
The Model Context Protocol turns an internal API into something an agent can call. The protocol is the easy part; the design decisions are which operations to expose, at what granularity, and under whose identity.
Both will build your containers. The differences that actually decide it are runner economics, how each handles multi-repo pipelines, and what happens to your secrets.
Teams argue about which model to use and then ship an assistant that answers confidently from the wrong document. The decisions that actually decide quality are about chunks, permissions, evaluation and cost.
Hosted minutes stop being cheap somewhere around 100,000 a month. Running your own runners on Kubernetes is straightforward; running them safely takes three specific decisions.
Pipeline duration is the cheapest developer productivity lever most teams never pull. Where the time really goes, and how to get a 40-minute build under 10 without changing CI vendor.
Most of the friction people blame on the model is a missing paragraph in the repository. What belongs in a context file, what does not, and why the ones that grow past a page stop working.
Nobody writes a minimal IAM policy from a blank page. You harvest it from what the role actually did. Here is the loop we run to shrink permissions without breaking production.
Argo CD is easy to install and easy to misuse. The repository layout, the sync policy and the secrets decision that separate a working GitOps setup from a dashboard full of red.
The static access key in your pipeline is the credential most likely to end up in a breach report. OIDC federation removes it in an afternoon, and the trust policy is where people get it wrong.
The bottleneck moved from writing to reviewing, and the old review habits do not scale to it. Four gates that keep quality without turning one senior engineer into a queue.
Shifting 10 percent of traffic to a new version is not a canary if nothing is watching. The metrics, the analysis window and the abort rule that make progressive delivery worth the complexity.
A posture review is only as good as its coverage. These are the scanners, IAM analysers and infrastructure-as-code checkers we run on AWS, Google Cloud and Azure, what each one is good at, and where it misleads.
One keeps you in the loop at every keystroke, the other takes a task away and brings back a diff. Most teams that argue about which to standardise on end up using both, for reasons that are easy to state.
Terraform creates the machine, Ansible decides what is on it. Where the boundary belongs, why provisioners are a trap, and what changes when your estate is mostly containers.
Kubernetes-native CI gives you pipelines as custom resources and scaling for free. It also gives you a pipeline engine you now operate. When that trade is worth making.
ARM instances are 20 to 40 percent cheaper for the same work, and the migration is mostly a build problem, not a code problem. Here is the order we do it in and the four things that bite.
A coding agent with shell access and repo context is a different tool from an autocomplete. The gains are real and they land unevenly; the cost is that review becomes the bottleneck. What we changed after six months.
An agent is an identity that takes instructions from text it did not write. Scope it like a service account you assume is partly compromised, because in the injection case it is.
Kubernetes hides waste better than any other platform, because everything looks busy. Four measurements tell you where the money goes, and three changes usually halve it.
An open-source assistant that lives on your own server, talks to you through the messaging app you already use and runs tools on your behalf. Genuinely useful, and the most over-permissioned thing most people will ever install.
The model is rarely the expensive part. Platform operations, the APIs you call, the retries and the human who checks the output usually add up to more. A worked breakdown of one real invoice-processing flow.
GuardDuty is enabled in most accounts and read in almost none. The fix is not more tuning, it is deciding in advance which five findings wake a human and what they do next.
Automations fail on a Tuesday at 3am and nobody notices until the customer calls. Four mechanisms — idempotency keys, bounded retries, a dead letter queue and an alert that names the business event — fix most of it.
An AI node in a workflow is a non-deterministic step in a deterministic pipeline. That is fine for classification and drafting, and dangerous for routing and writes. Here is where we draw the line.
Public buckets are the headline and the easy part. The leaks we find now come from bucket policies, presigned URLs, replication and logs nobody reads. Here is the full pass.
In Make, every module run is money, so the cheapest scenario and the fastest scenario are usually the same one. Five patterns that cut consumption by half without changing what the automation does.
ISO 27001, SOC 2, ENS and NIS2 overlap heavily. Running them as four separate projects triples the cost. How to build a single control set with a single evidence pipeline, and where the mapping genuinely breaks down.
The three tools do the same demo. They diverge on pricing shape, where your data sits, and what happens when a workflow needs real code. Pick on those, not on the connector count.
Knowledge Bases, Guardrails and Agents remove a lot of plumbing. They do not remove the retrieval, permission and evaluation decisions, and that is where projects still fail.
n8n on a single container is a demo. Running it for a company means queue mode, a real database, a plan for credentials and a restore you have tested. Here is the shape that survives.
DORA applies to banks and insurers, but its contractual and oversight provisions reach their ICT providers directly. What changes in your contracts, your exit plans and your incident reporting if your customers are regulated.
An agent with cloud credentials is the most useful and most dangerous automation you can build. The pattern that works is investigation with a read-only role and change as a reviewed plan.
Most Terraform pain is not HCL. It is one enormous state file, applies from laptops and three years of manual console changes nobody imported. Here is how we untangle it.
Whatever platform draws the boxes, the automations that stay up have the same three pieces underneath. Here is the shape, and the five decisions that make it hold under load.
Every control in PCI DSS applies to everything in scope, so the cheapest compliance project is the one that removes systems from scope. How tokenisation, segmentation and a hosted payment page change the size of the problem.
A prompt is production configuration that changes behaviour silently. Treat it like code, and build the smallest evaluation that can tell you whether a change made things better.
Aurora is not automatically better or cheaper. It wins on specific axes, loses on others, and the migration has one path that keeps downtime under a minute. Here is the decision and the runbook.
An agent that clicks through a web interface can automate systems that have no API at all. It is also the most fragile automation you can build. Where the trade actually lands, and how to make the fragile version survive.
Two supplementary standards that extend ISO 27001 into cloud services and personal data in the cloud. What each adds, who actually asks for them, and how much extra audit they cost.
Not a strategy deck. A sequence: find the work, ship one thing that matters, build the platform underneath it, then let other people build. What goes wrong at each stage and how to tell if it is working.
Networking mistakes in AWS are the expensive kind, because fixing them means moving workloads. These six come up in almost every estate we review, and five of them are cheap to get right on day one.
The Esquema Nacional de Seguridad is not optional if you want public sector contracts in Spain. How the categories work, what the 2022 revision changed, and where a cloud-native company usually fails.
In GCP the project is the blast radius and the folder is where policy lives. Most estates we see have neither used deliberately. Here is the structure we deploy and the eight policies we set on day one.
NIS2 pulled in far more companies than its predecessor, added personal liability for management, and set a 24-hour first notification. What the directive actually requires, in engineering terms.
On-demand BigQuery charges for bytes scanned, so one badly written dashboard can cost more than your compute. Here is how we cap it without slowing anyone down.
A Type II window means proving, month after month, that controls ran. Collecting that by hand consumes an engineer. What to automate, what to buy, and what still has to be done by a person.
Almost every Google Cloud incident we have investigated started with a JSON key file. Workload Identity Federation removes the need for them entirely, and the migration is smaller than you think.
Type I is a photograph, Type II is a film. The choice changes your timeline by months and what a customer will accept. How to pick, how long each takes, and where the money goes.
Autopilot charges for what your pods request and removes node management. That is a better deal than it sounds for most teams and a worse one for a few. Here is how to tell which you are.
Most ISO 27001 projects write the SoA last, as a spreadsheet of 93 rows marked "applicable". Done properly it falls out of the risk assessment, and it is what makes the rest of the audit go quickly.
Vertex gives you a managed vector search, a grounding API and an evaluation service. Two of those are worth taking as-is. Here is how we assemble a production assistant on Google Cloud.
A company running entirely on managed cloud services already satisfies a large part of Annex A without knowing it. The work is evidencing that, and finding the dozen controls that genuinely need building.
Most teams running GKE would be better served by Cloud Run, and a few running Cloud Run are fighting it. The decision is not about scale — it is about four specific requirements.
An open-source SIEM is a real option when the alternative is paying per gigabyte, but only if you accept the operational cost. What Wazuh gives you out of the box, what you have to build, and when to stop and buy.
SCC Premium turns on and produces thousands of findings in an hour. Here is the triage order that gets an estate from "unreadable" to "twelve open items" in about three weeks.
Identity is where the escalation happens, and graphs are how you see it. What BloodHound reveals about Active Directory and Entra ID, how to read the paths, and which edges are worth cutting first.
CUDs come in two flavours that behave very differently, and buying the wrong one locks you to a machine family for three years. Here is the sequence we follow.
Dependency scanning is mature; what changed is that customers and regulators now ask for the inventory itself. How to generate SBOMs that are useful rather than ceremonial, and how to answer "are we affected?" in an hour.
IAM stops the wrong people reading your data. It does not stop the right people copying it somewhere else. Service perimeters do, and they will break things on the way in. Here is how to roll one out without an outage.
Finding a credential in git history is the easy part. The hard parts are verifying it is live, rotating it without an outage, and stopping the next one — in that order, and usually within the hour.
The google provider has behaviours that will surprise you the first time — authoritative IAM resources that wipe bindings, projects that will not delete, APIs that must be enabled before anything works. Here is the setup we use.
Every image scan returns hundreds of CVEs and almost none of them are reachable. How we cut the list down to what is exploitable, where each tool is stronger, and why the base image is the whole game.
The Cloud Adoption Framework reference architecture is large and most teams deploy a fraction of it. Here is the subset that carries the weight: management groups, subscription boundaries and the policies that hold it together.
Most static analysis dies from noise. The way to keep SAST alive is to start with a tiny high-precision rule set, write rules for your own codebase's mistakes, and scan the diff rather than the repository.
Conditional Access is the strongest control in Entra ID and the easiest way to lock your entire organisation out of its own tenant. Here is the baseline set, and the order to deploy it in.
Dynamic scanning in a pipeline fails for predictable reasons: no authentication, no seeded data, a scan that takes forty minutes and a threshold that fails builds on informational alerts. How to configure ZAP so the result is trusted.
Azure has more discount mechanisms than any other cloud and they stack in a specific order. Get the order wrong and you commit to capacity a hybrid benefit would have made unnecessary.
Nuclei is fast enough to run against your whole external surface every night. The value is in the template selection, the target list and the diff between runs, not in the raw number of findings.
Network plugin, identity model, node pool layout and upgrade strategy are all chosen in the first hour and all painful to change afterwards. Here is what we pick and why.
The scanner is the least interesting part of Burp. This is how we set up scope, authentication and session handling for a web application assessment, which extensions earn their place, and how to tell a finding from a false positive.
The model is the easy part. What decides whether an Azure OpenAI assistant reaches production is token quota per region, private networking and whether retrieval respects who is asking.
Nmap still finds the things that matter on a cloud perimeter, but only if you scan the right address space with the right flags. How we build the target list, which scan types earn their time, and how to read the output without wasting a week.
Defender has eight separately priced plans and a score that rewards volume over risk. Here is how we decide which plans earn their cost and how to triage the recommendations that matter.
Locking down PaaS services in Azure is straightforward until the name resolution breaks in a way that only shows up from one subnet. Here is the model that works and how to lay out the hub.
Azure Policy is the strongest governance engine of the three big clouds and the easiest to misuse. Here is how we write, test and roll out policy so a Deny effect never surprises a deployment.
The three options differ on features, cost and how much of your existing database you have to change. Here is the decision tree and the migration that keeps downtime short.
Bicep is better at Azure than Terraform in several specific ways, and worse in several others. The right answer depends on whether Azure is your only cloud and who maintains the code.
Oracle Cloud puts everything in one tenancy and separates it with compartments. That is a different model from AWS accounts or Azure subscriptions, and copying either one produces a mess.
An OCI policy statement is one readable line, and one readable line can grant far more than it appears to. Here is how we write, verify and constrain them.
OCI prices egress and compute differently enough that a like-for-like comparison with AWS misleads in both directions. Here is what genuinely moves and how we model it.
Oracle's managed Kubernetes is closer to the others than people expect, with three genuine differences: the free control plane, the ARM allowance and a networking model you choose at creation.
It genuinely removes patching, tuning and backup configuration. It does not remove schema design, connection management or the need to understand what your queries do. Here is where it fits.
Most cloud security products tell you what went wrong. Security Zones refuse the misconfiguration at creation. That is a meaningful difference, and it is the OCI feature worth building around.
A VCN looks like a VPC until you meet the four gateway types and two firewall models. Here is the layout we build and the specific choices that avoid rework.
Oracle's managed model service covers the plumbing for a standard assistant, including a vector-capable database you probably already have. Here is the architecture and the decisions it does not make for you.
Oracle ships a managed Terraform service that removes the backend and the runner. Here is when it is the right call, when to run your own pipeline, and the OCI-specific things that catch people.
Most services have a counterpart and the translation is mechanical. Three things are not mechanical, and they decide whether the migration is worth doing at all.