Environment Separation Is a Claim Until Someone Reads the Config
A production service that answered every check was reading development tables and publishing an index with no version history in it at all.
Vulnerability Management
Exposure reduction, attack surface, metrics that change decisions, and control assurance.
19 articles
The Cheapest Control Is the One That Deletes the Exposure
A chat integration appeared to require a public webhook endpoint into a machine I own, and the transport that removed the endpoint entirely cost less than any control I would have put in front of it.
Most Audit Findings Are Drift, Not Missing Controls
Nine findings came out of one adversarial audit. Two were exploitable defects and five were divergence between what the documentation claimed and what the code did.
When the Remediation Is the Defect
A security finding about swallowed email errors was fixed correctly, and the same commit is why the notification emails stopped arriving for four days.
The Finding Count Fell and the Severity Did Not
Five review passes over one backend in seven days. The finding count fell every time, the top severity band did not move until the last pass, and two of those top findings were defects the pass before had introduced.
When Remediation Creates New Findings
A batch of twenty-seven security fixes closed cleanly and produced a critical regression plus fifteen new findings inside the hour, because the firewall at the heart of it had been added to the template and attached to nothing.
The Revert That Reopened a Vulnerability
A Next.js downgrade that fixed a broken static export also put five open security advisories back into the lockfile for fifteen hours, and nothing recorded that as a decision.
What Automating a Zero Trust Assessment Taught Me About Maturity Scores
Writing a maturity score down as a function forces you to answer the scoring questions a consultant never has to say out loud, starting with what an unanswered question is worth.
Cloud Security Assurance: Proving Controls in Real Time
Control claims are cheap. Assurance improves when teams can produce timely evidence that controls are operating as designed.
Measuring Cybersecurity Effectiveness Without Vanity Metrics
Effective security metrics should change decisions, not just decorate dashboards.
Modern Vulnerability Management: Risk Over Counts
Counting vulnerabilities is easy. Reducing real risk requires better prioritization, ownership, and remediation execution.
Cloud Permission Sprawl and How to Fix It
Cloud IAM debt accumulates quietly until attackers exploit it. Here is a practical model for reducing permission sprawl safely.
Board Cyber Reporting: Metrics That Drive Decisions
Boards do not need more dashboard noise. They need metrics tied to business decisions, material risk, and response readiness.
Attack Surface Management: From Periodic Scans to Continuous Visibility
Periodic vulnerability scans miss the assets attackers find first. Continuous attack surface management closes that gap.
Security Metrics That Matter: What to Report to the Board
Boards don't need more security data. They need decision-grade metrics that connect controls, risk movement, and business impact.
Log4j: Why Software Composition Analysis Isn't Optional
Log4Shell exposed what many teams already suspected: you can't defend what you can't inventory. SCA is now foundational, not optional.
Open Source Vulnerability Management at Enterprise Scale
Managing open source risk at enterprise scale requires process discipline, ownership, and signal-focused prioritization — not endless alert volume.
OWASP Top 10 in Practice: What Actually Matters
The OWASP Top 10 is useful, but only if teams translate it into real engineering decisions and risk priorities.
The Real Cost of Ignoring Software Composition Analysis
Most enterprises don't know what's inside the software they ship. Software Composition Analysis isn't optional anymore — here's what ignoring it actually costs.