Engineering notes
The thinking behind better security decisions.
Practical notes on how connected context changes security work. Documentation and API reference will be published with product availability.
Understanding Cloud Attack Paths
An attack path is a chain of conditions, not a single finding. Here is how to reason about entry points, pivots and targets in cloud environments.
Read noteConnecting Vulnerability Findings to Runtime Context
Severity scores describe a vulnerability in isolation. Runtime context — deployment, reachability, identity — describes what it means for you.
Read noteEvaluating Identity Permissions and Blast Radius
Effective access is what an identity can actually do once policies, boundaries and trust relationships are combined. That is the real blast radius.
Read noteBuilding Reviewable Security Remediation Workflows
Good remediation proposals show the change, the reasoning, the expected effect and the residual risk — and leave the decision with the owner.
Read noteSecurity Considerations for AI-Assisted Engineering
AI assistants and agents introduce new identities, new data flows and new ways for untrusted input to influence actions. Model them like any other system.
Read note