Fail Closed on the Server, Fail Open at the Client
Two commits a day apart set opposite failure defaults in the same backend, and what decided each one was not the sensitivity of the asset but who gets refused when the control is wrong.
Identity & Access
IAM, privileged access, and identity as the control plane attackers reach for first.
11 articles
Shipping a Control That Can Lock Out Your Own Users
Device attestation is a control where a correct implementation and a botched rollout produce the same 403, so the rollout mechanics matter more than the cryptography.
Freeze, Destroy, and the Grants You Give Back
Two AWS systems went dark seventeen days apart. Deciding how to stop them took more security work than building them did, and the artifacts I preserved were deleted eighteen days later by someone doing a legitimate job.
Two Platforms Need Two App Clients, Not a Looser Audience Check
Adding Android to a backend built for iOS forced a choice between relaxing JWT audience validation and issuing a second client identity, and the cheaper-looking option was the one that destroyed information.
Review the Tool List, Not the System Prompt
A GenAI security review that spends its budget on whether the model can be talked into saying something forbidden has assessed the half of the system that does not act. The half that acts is the tool list.
Least Privilege for Non-Human Developers
An agent's permissions are whatever its tools can reach, not whatever its role description says, so the policy has to be written at the tool boundary and tested like a control.
Identity-First Security Operations at Enterprise Scale
At enterprise scale, identity telemetry is often the fastest signal for active compromise. Operations need to be built around that reality.
Cloud Permission Sprawl and How to Fix It
Cloud IAM debt accumulates quietly until attackers exploit it. Here is a practical model for reducing permission sprawl safely.
Identity Threat Detection and Response (ITDR): What You Need to Know
ITDR has moved from emerging category to operational necessity as attackers increasingly target identity systems, session tokens, and MFA weaknesses.
Identity Is the New Perimeter: IAM in a Post-COVID World
Remote work made one thing clear: perimeter controls are no longer enough. Identity has become the control plane for enterprise security.
Building a Zero Trust Roadmap That Actually Works
Most Zero Trust programs fail because they start with tools instead of outcomes. Here's a practical roadmap that works in real enterprises.