Vault or your cloud's secret manager
The choice is not about features. It is about whether you are multi-cloud, whether you need short-lived database credentials, and how much operational load your team can carry.
Blog
Security
The findings that repeat across accounts, the tools that surface them and the changes that actually close them.
The US state privacy patchwork: what a GDPR-compliant SaaS still has to build
California set the template and a growing list of states copied it with variations. What differs from GDPR, why the browser opt-out signal is the part teams miss, and how to build once for a list that keeps growing.
“Read-only” is a claim until something checks it: how Skyline verifies credentials before scanning
Most inventory tools ask for read-only access and trust you got it right. We made Skyline prove it first, because the ReadOnlyAccess policy a team hands you is very often not what they think it is.
Rotation nobody does, because it breaks things
Rotation fails when the application reads the secret once at startup. Two valid credentials during the change window, an inventory that is real, and deletion instead of rotation for the credentials that should not exist at all.
Prompt injection: you do not fix it with a better system prompt
Any agent that reads untrusted content and can act will eventually take instructions from that content. The defences that work are architectural, not textual.
osquery turns your fleet into a table you can select from
Most questions during an incident or an audit are inventory questions, and most organisations answer them with a spreadsheet. A SQL interface over live endpoint state answers them in seconds, and the scheduling is where it goes wrong.
Metasploit for confirming a finding, not for the demo
A scanner says a host is probably vulnerable. Controlled exploitation in an authorised engagement turns "probably" into "here is what an attacker gets", which is the difference between a finding people fix and one they file.
Policy in the cluster, without the webhook that takes it down
Kyverno or Gatekeeper is a smaller decision than how you roll policy out. Audit, then warn, then enforce, with system namespaces excluded and a failure policy you have thought about.
Cluster posture scanning, and the six findings that are always there
Every Kubernetes benchmark scan produces hundreds of findings and the same handful matter. Here is which ones, why the control plane checks mostly do not apply on managed clusters, and how to stop the report being ignored.
ISO 42001 is the management system your AI Act file will lean on
It is not a certification of your model. It is the scaffolding that makes AI governance repeatable, and if you already run ISO 27001, most of the machinery is built.
The runbook you use at 3am, not the one you show the auditor
Severity defined by criteria instead of instinct, three roles, one timeline and a named person who decides whether to notify. Everything else in an incident process is optional.
HIPAA on cloud infrastructure, where scope reduction does most of the work
The business associate agreement is the easy part. Which services you may use, which data you can avoid holding, and the six technical safeguards that turn into actual configuration.
GDPR as engineering controls, not legal theory
The auditor does not read your privacy policy. They ask which system holds personal data, how long it keeps it, who can read it and what happens when someone asks for a copy. Those are engineering questions.
Selling to the US public sector: FedRAMP against SOC 2, honestly
They look like neighbours and they are not. One is an attestation you commission, the other is an authorisation you earn against a prescribed control baseline, and the cost difference is an order of magnitude.
Falco tells you what a container did, not what it might do
Image scanning finds known vulnerabilities before deployment. Runtime detection catches the shell that spawned inside a running pod at three in the morning. The default rules are noisy and tuning them is the entire project.
A Kubernetes Secret is base64, and everyone learns this too late
Getting secrets out of manifests means an operator that syncs from your cloud's vault, a driver that mounts them, or both. The part that decides which is what your application does when the value changes.
Where your data actually sits, and what the buyer is really asking
Transfer mechanisms, region choice and support access are three different questions that get merged into one. How to answer a European buyer's questionnaire with facts rather than assurances.
The Cyber Resilience Act turns your product into a regulated object
If you sell software or connected hardware into the EU, security stops being a quality attribute and becomes a market access requirement, with a vulnerability reporting clock and a support period you must declare.
The EU AI Act, translated into engineering work
Most teams either assume the AI Act does not touch them or assume it bans what they are building. How to establish your role and risk tier, and what the obligations cost an engineering team.
Detection as code, so your rules survive changing your SIEM
Sigma is a vendor-neutral format for detection logic that compiles to your platform's query language. The format is the easy part. Version control, testing and a lifecycle for rules are what make detection work.
Your detections are untested until you generate the behaviour
A rule that has never fired is either excellent or broken, and you cannot tell from the outside. Adversary emulation runs the technique deliberately, in a controlled way, so that the answer stops being a guess.
Least privilege in AWS without guessing: the Access Analyzer workflow
Nobody writes a minimal IAM policy from a blank page. You harvest it from what the role actually did. Here is the loop we run to shrink permissions without breaking production.
Getting long-lived cloud keys out of your CI
The static access key in your pipeline is the credential most likely to end up in a breach report. OIDC federation removes it in an afternoon, and the trust policy is where people get it wrong.
Eight open-source tools we run in every cloud posture review
A posture review is only as good as its coverage. These are the scanners, IAM analysers and infrastructure-as-code checkers we run on AWS, Google Cloud and Azure, what each one is good at, and where it misleads.
Permissions for agents that act: sizing the blast radius before you hand over the keys
An agent is an identity that takes instructions from text it did not write. Scope it like a service account you assume is partly compromised, because in the injection case it is.
Turning GuardDuty from noise into a rota someone answers
GuardDuty is enabled in most accounts and read in almost none. The fix is not more tuning, it is deciding in advance which five findings wake a human and what they do next.
S3 security beyond "block public access": the eight checks we run
Public buckets are the headline and the easy part. The leaks we find now come from bucket policies, presigned URLs, replication and logs nobody reads. Here is the full pass.
One control set, four frameworks: mapping compliance so you only do the work once
ISO 27001, SOC 2, ENS and NIS2 overlap heavily. Running them as four separate projects triples the cost. How to build a single control set with a single evidence pipeline, and where the mapping genuinely breaks down.
DORA for a technology supplier to financial entities
DORA applies to banks and insurers, but its contractual and oversight provisions reach their ICT providers directly. What changes in your contracts, your exit plans and your incident reporting if your customers are regulated.
PCI DSS 4.0 in the cloud: the only strategy that works is shrinking the scope
Every control in PCI DSS applies to everything in scope, so the cheapest compliance project is the one that removes systems from scope. How tokenisation, segmentation and a hosted payment page change the size of the problem.
ISO 27017 and 27018: the cloud extensions worth adding, and when they are not
Two supplementary standards that extend ISO 27001 into cloud services and personal data in the cloud. What each adds, who actually asks for them, and how much extra audit they cost.
ENS certification for a cloud supplier selling to Spanish public administration
The Esquema Nacional de Seguridad is not optional if you want public sector contracts in Spain. How the categories work, what the 2022 revision changed, and where a cloud-native company usually fails.
NIS2: whether you are in scope, and what it asks of an engineering team
NIS2 pulled in far more companies than its predecessor, added personal liability for management, and set a 24-hour first notification. What the directive actually requires, in engineering terms.
Automating SOC 2 evidence so the observation window is not a second job
A Type II window means proving, month after month, that controls ran. Collecting that by hand consumes an engineer. What to automate, what to buy, and what still has to be done by a person.
Service account keys are the GCP credential that leaks. Here is how to stop creating them
Almost every Google Cloud incident we have investigated started with a JSON key file. Workload Identity Federation removes the need for them entirely, and the migration is smaller than you think.
SOC 2 Type I or Type II: which one to do first, and what it actually costs
Type I is a photograph, Type II is a film. The choice changes your timeline by months and what a customer will accept. How to pick, how long each takes, and where the money goes.
The Statement of Applicability is the document the auditor reads first
Most ISO 27001 projects write the SoA last, as a spreadsheet of 93 rows marked "applicable". Done properly it falls out of the risk assessment, and it is what makes the rest of the audit go quickly.
ISO 27001 Annex A in a cloud-native company: which controls are already done
A company running entirely on managed cloud services already satisfies a large part of Annex A without knowing it. The work is evidencing that, and finding the dozen controls that genuinely need building.
Wazuh as a small team's SIEM: what it does well and where it hurts
An open-source SIEM is a real option when the alternative is paying per gigabyte, but only if you accept the operational cost. What Wazuh gives you out of the box, what you have to build, and when to stop and buy.
Security Command Center without the wall of findings
SCC Premium turns on and produces thousands of findings in an hour. Here is the triage order that gets an estate from "unreadable" to "twelve open items" in about three weeks.
BloodHound and the identity attack path: from a helpdesk account to domain admin
Identity is where the escalation happens, and graphs are how you see it. What BloodHound reveals about Active Directory and Entra ID, how to read the paths, and which edges are worth cutting first.
OSV-Scanner, SBOMs and the supply chain question customers now ask
Dependency scanning is mature; what changed is that customers and regulators now ask for the inventory itself. How to generate SBOMs that are useful rather than ceremonial, and how to answer "are we affected?" in an hour.
VPC Service Controls: the only real defence against data exfiltration in GCP, and why it is hard
IAM stops the wrong people reading your data. It does not stop the right people copying it somewhere else. Service perimeters do, and they will break things on the way in. Here is how to roll one out without an outage.
Secret scanning with Gitleaks and TruffleHog, and what to do the moment one is found
Finding a credential in git history is the easy part. The hard parts are verifying it is live, rotating it without an outage, and stopping the next one — in that order, and usually within the hour.
Trivy and Grype: making container scanning produce fixes instead of numbers
Every image scan returns hundreds of CVEs and almost none of them are reachable. How we cut the list down to what is exploitable, where each tool is stronger, and why the base image is the whole game.
Semgrep rules developers actually keep: SAST that does not get switched off
Most static analysis dies from noise. The way to keep SAST alive is to start with a tiny high-precision rule set, write rules for your own codebase's mistakes, and scan the diff rather than the repository.
Conditional Access policies that hold, and the emergency account you must create first
Conditional Access is the strongest control in Entra ID and the easiest way to lock your entire organisation out of its own tenant. Here is the baseline set, and the order to deploy it in.
OWASP ZAP in CI without breaking every build
Dynamic scanning in a pipeline fails for predictable reasons: no authentication, no seeded data, a scan that takes forty minutes and a threshold that fails builds on informational alerts. How to configure ZAP so the result is trusted.
Nuclei as a continuous attack surface check, not a one-off scan
Nuclei is fast enough to run against your whole external surface every night. The value is in the template selection, the target list and the diff between runs, not in the raw number of findings.
A Burp Suite workflow that finds real bugs, not just alerts
The scanner is the least interesting part of Burp. This is how we set up scope, authentication and session handling for a web application assessment, which extensions earn their place, and how to tell a finding from a false positive.
Nmap against a cloud perimeter: what is worth scanning and what is noise
Nmap still finds the things that matter on a cloud perimeter, but only if you scan the right address space with the right flags. How we build the target list, which scan types earn their time, and how to read the output without wasting a week.
Defender for Cloud: what to enable, what to ignore and why secure score is not the goal
Defender has eight separately priced plans and a score that rewards volume over risk. Here is how we decide which plans earn their cost and how to triage the recommendations that matter.
Azure Policy as code: the deployment pattern that does not cause outages
Azure Policy is the strongest governance engine of the three big clouds and the easiest to misuse. Here is how we write, test and roll out policy so a Deny effect never surprises a deployment.
OCI policies read like English, which is why they are easy to get dangerously wrong
An OCI policy statement is one readable line, and one readable line can grant far more than it appears to. Here is how we write, verify and constrain them.
Cloud Guard and Security Zones: OCI's prevention layer is better than its detection layer
Most cloud security products tell you what went wrong. Security Zones refuse the misconfiguration at creation. That is a meaningful difference, and it is the OCI feature worth building around.
Security