Agentless vs Agent-Based Cloud Security
Agentless API snapshots versus runtime agents: what each sees, the blind spots of both, and a hybrid design that does not double-ticket every CVE.
Read article →Blog
Browse by topic, filter by tag, or search by keyword.
Popular tags
CNAPP & CSPM
Posture management, attack paths, exposure, and prioritization.
Architecture of a Self-Hosted CSPM
How a self-hosted CSPM is built: collectors and credentials, the graph store, the policy engine, and multi-tenant isolation—not a recap of which scanner to buy.
Read article →ASPM vs CNAPP: Application Posture vs Cloud Posture
ASPM vs CNAPP is not two names for the same platform. ASPM inventories apps, APIs, and code risk; CNAPP inventories cloud resources and IAM. Shared runtime is where the queues collide.
Read article →Attack Path Analysis in Cloud Security: A Practical Guide
Learn what attack path analysis is, how cloud attack paths are modeled in a security graph, and why graph-native CNAPP tools prioritize reachable risk over flat alert lists.
Read article →Cloud Detection and Response (CDR) vs CSPM
CDR versus CSPM: state versus events, the telemetry you actually need, detections that require graph context, and where GuardDuty, SCC, and Defender fit.
Read article →Cloud Security KPIs Boards Actually Understand
Board-ready cloud security KPIs: stop reporting raw criticals, track internet-facing count, path-open time, exception age, and a sample monthly pack.
Read article →CSPM vs CNAPP: What's the Difference (and Why the Security Graph Matters)
Compare CSPM vs CNAPP for cloud security. Learn how attack path analysis and security graphs help teams prioritize misconfigurations and vulnerabilities that attackers can actually reach.
Read article →How to Prioritize Cloud Vulnerabilities When Everything Is "Critical"
A practitioner guide to cloud vulnerability prioritization beyond CVSS — using exposure, attack paths, and asset context to fix what attackers can actually exploit.
Read article →Open Source CSPM and CNAPP Tools in 2026: What Exists Today
Survey of open source CSPM, self-hosted CNAPP alternatives, and graph-native cloud security tools in 2026 — plus how to evaluate self-hosted options for your team.
Read article →Reachable Risk: Ranking Cloud Findings by Attack Path
Rank cloud findings by reachable risk: network plus identity paths, why private subnets lie, and ticket text that includes the actual attack path.
Read article →
AWS
IAM, S3, EKS, GuardDuty, and AWS service hardening guides.
Amazon CloudFront Security: OAC, TLS, and Origin Lockdown
Amazon CloudFront security that actually holds: Origin Access Control instead of OAI, HTTPS only, S3 bucket policies that deny non-CloudFront, WAF attachment, and the bypass of hitting the bucket URL directly.
Read article →Amazon DocumentDB Security Hardening: TLS, IAM, and No Public 27017
Harden Amazon DocumentDB with TLS 1.2, encryption at rest, no public access, scoped IAM or secrets, audit logs, and snapshot controls—then verify no internet path to the cluster.
Read article →Amazon EventBridge Security: Bus Policies and API Destinations
Amazon EventBridge security: default-bus vs custom bus resource policies, cross-account PutEvents, API destinations and connection secrets, and encryption that does not cover the event you already leaked to a partner.
Read article →Amazon RDS Security: Encryption, IAM Auth, and Public Access
Lock down Amazon RDS: KMS at rest, TLS in transit, IAM database auth, PubliclyAccessible false, snapshot exposure, and the security-group mistakes that still publish Postgres to 0.0.0.0/0.
Read article →Amazon SageMaker Security for ML Workloads in Production
Lock down SageMaker Studio, training jobs, and endpoints: VPC-only, scoped execution roles, no root on notebooks, encrypted data, and private model APIs.
Read article →Amazon Verified Permissions and Cedar for App AuthZ
Amazon Verified Permissions Cedar is application authorization, not IAM and not CSPM. Policy shape, when AVP is the wrong tool, and mapping API actions to the same identities a security graph already has.
Read article →AWS Control Tower Detective Guardrails That Matter
Control Tower detective guardrails are Config rules, not SCPs. Skip duplicates of preventive policies, fix recorder ownership, and map remaining noncompliant resources onto attack paths.
Read article →AWS Glue Security: Job Roles, Catalog Encryption, and Connections
AWS Glue security for ETL: least-privilege job roles, Lake Formation vs IAM, connection credentials, catalog encryption, and why a crawler role that can s3:* is an exfil path.
Read article →AWS Lambda Security: Execution Roles, Resource Policies, and Function URLs
AWS Lambda security that matters in prod: execution-role blast radius, resource-based policies, Function URL auth, public layers, and env vars that are still plaintext secrets.
Read article →AWS Resource Control Policies (RCPs) vs SCPs
AWS resource control policies are Organizations resource-based guardrails: they cap what any caller—including principals outside the org—can do to member-account resources. SCP vs RCP vs IAM, a public-S3 deny, sandbox OU tests.
Read article →AWS S3 Bucket Security Hardening: Block Public Access and Beyond
Harden AWS S3 with account-level Block Public Access, bucket policies over ACLs, KMS encryption, VPC endpoints, and Access Analyzer—then rank leftover risk by attack path.
Read article →AWS Security Best Practices: A Practitioner Checklist for 2026
Org-first AWS hardening: Identity Center over access keys, SCPs that actually deny, org CloudTrail, S3 Block Public Access, and the failure modes that keep those controls from working.
Read article →CloudFormation Hooks as Preventive Guardrails
CloudFormation Hooks versus Config and SCPs: a deny-public-S3 hook on create, the IAM role the hook runs as, and the failure modes that fail open.
Read article →Enforce IMDSv2 and Hop Limit 1 on EC2
IMDSv2 hop limit 1 stops SSRF and container theft of instance-profile keys. CLI, launch templates, account defaults, SCPs, and the failure modes that send hop limit back to 2.
Read article →IAM Access Analyzer Unused Access in Organizations
IAM Access Analyzer unused access is a paid org analyzer, not the free external-access findings. Delegated admin, service-linked noise, tracking-period traps, and turning findings into permission boundaries.
Read article →Multi-Account AWS Attack Paths: Trust Policies and SCPs
How AssumeRole, resource policies, and SCPs create org-wide AWS attack paths, including trusts and denies that do not apply where you think.
Read article →Public EBS Snapshots: Finding and Killing Them
Public EBS snapshot exposure is CreateVolumePermission group=all, not a bucket ACL. Account-level block-all-sharing, hunt commands, and the AMI side channel Block Public Access for snapshots does not close.
Read article →Securing Terraform State in S3
Terraform state in S3 is a secret store: encrypt it, Block Public Access, lock it, and treat s3:GetObject on the state key as production credential access.
Read article →VPC Endpoints vs NAT: Security and Data Paths
VPC endpoint vs NAT gateway security is not a cost conversation. NAT still egresses to public AWS APIs; gateway vs interface endpoints; endpoint policies as IAM; put S3 and STS on private paths first.
Read article →
Azure
Defender, AKS, Key Vault, and Microsoft cloud security.
Azure Application Gateway WAF: OWASP Rules, Tuning, and What WAF Cannot Do
Run Application Gateway WAF_v2 in Prevention with OWASP CRS, custom rules, and Log Analytics—without treating WAF as authentication or network segmentation.
Read article →Azure CSPM Implementation Guide: From Defender to Custom Policies
Turn on Defender for Cloud CSPM at the management group, assign MCSB with Deny, export to Log Analytics, and avoid Secure Score theater and exemption rot.
Read article →Azure Federated Identity Credentials Instead of Client Secrets
Replace app-registration client secrets in GitHub Actions with Azure federated identity credentials: OIDC issuer, subject, audience, leftover secrets, and az commands.
Read article →Azure Landing Zone Deny Assignments That Block Owners
CAF-style deny assignments vs Policy Deny, platform vs app landing zones, break-glass, and debugging “I am Owner but cannot delete.”
Read article →Azure Private Endpoints: The DNS Gotchas That Re-Expose Services
Private endpoints that still resolve to public IPs: zone linking, split-brain resolvers, missing privatelink zones, and Storage/Key Vault examples you can query.
Read article →Azure Resource Graph Queries for Security Review
Use Azure Resource Graph KQL for public IPs and open NSGs at management-group scope, when ARG beats Policy, and how to export hits into a security graph.
Read article →Entra PIM: Eligible vs Active Privileged Roles
Standing Owner is the finding; eligible is still a path. Approval, MFA on activate, Graph/PIM APIs, and how to put eligible edges on a security graph.
Read article →
Google Cloud
GKE, IAM, VPC Service Controls, and GCP posture management.
Custom Organization Policy Constraints on GCP
Write GCP custom organization policy constraints in CEL, dry-run them, and use them when IAM cannot express a resource-shape rule. Not a generic org policy recap.
Read article →GCP IAM Deny Policies: How They Override Allows
GCP IAM deny policies evaluate after the allow union: attachment points, a key-creation deny you can test, lockout paths, and exceptions that do not become standing admin.
Read article →GCP IAM Security Hardening: Roles, Conditions, and Service Accounts
Stop using basic roles and JSON keys: folder inheritance, IAM deny policies, organization constraints, Workload Identity Federation, and the default Compute SA.
Read article →GCP Principal Access Boundaries Explained
Principal Access Boundary policies cap which resources a principal can touch: PAB vs IAM deny vs org policy, a contractor example, and how to test before binding.
Read article →GCP Workforce Identity Federation for Human SSO
Workforce Identity Federation maps IdP groups to GCP IAM for humans—no Cloud Identity user required. Not Workload Identity Federation (that is CI and GKE).
Read article →GitLab CI to GCP with Workload Identity Federation
GitLab CI Workload Identity Federation: attribute mapping, protected branches, leftover JSON keys, and when Cloud Build is the better runner than GitLab.
Read article →GKE Autopilot Security Trade-offs vs Standard
What GKE Autopilot actually locks (nodes, privileged, hostPath) versus what you still own: IAM, images, Workload Identity, and the cases where Standard is the only honest choice.
Read article →Google Cloud Armor WAF Rules and DDoS Protection
Set up Cloud Armor on a Google Cloud load balancer: L3/L4 DDoS, preconfigured OWASP WAF rules, rate limiting, Adaptive Protection, Terraform, and preview mode.
Read article →VPC Service Controls: Dry-Run Then Enforce
Operator sequence for VPC Service Controls: perimeter vs IAM, dry-run logs, Cloud Build false positives, then a staged enforce. This is not a WAF.
Read article →
Kubernetes
RBAC, network policies, admission control, and cluster security.
Cloud-Native Application Security: Design Patterns for Secure Apps
Seven design patterns for securing cloud-native apps on Kubernetes and serverless—supply chain, identity, network, secrets, APIs, runtime, and attack-path context.
Read article →Cosign Keyless Signing and Admission on Kubernetes
Cosign keyless signing with Fulcio and Rekor, admission via Kyverno or VAP, and the air-gap limits that force you back to keys on Kubernetes.
Read article →From Compromised Pod to Cloud Admin: The IRSA/WI Path
Trace the IRSA and Workload Identity path from a compromised pod to cloud admin, then break that path at the annotation before the cloud role.
Read article →Image Provenance and SLSA on Kubernetes
SLSA levels that actually ship in production Kubernetes: Cosign attestations at admission, why a CVE scan is not provenance, and how to kill :latest.
Read article →KSPM Explained: Kubernetes Security Posture Beyond CIS YAML
KSPM beyond CIS YAML: cluster config versus workload identity, connecting findings to cloud IAM, and where admission control differs from scans.
Read article →Kubernetes RBAC Security Best Practices for Production Clusters
Production Kubernetes RBAC: namespace Roles not cluster-admin, automount off, bound tokens, aws-auth vs access entries, and kubectl-who-can in CI.
Read article →Kubernetes Validating Admission Policy (CEL) vs Webhooks
Native ValidatingAdmissionPolicy with CEL: built-in policies, when you still need Kyverno or Gatekeeper, parameter resources, and FailurePolicy Fail vs Ignore.
Read article →Projected Service Account Tokens in Kubernetes
Replace never-expiring Secret-based service account tokens with TokenRequest projected volumes: audiences, expiry, pod-bound tokens, and how IRSA consumes them.
Read article →Seccomp and AppArmor for Kubernetes Workloads
RuntimeDefault seccomp and AppArmor annotations for Kubernetes: what syscalls they block, why they do not stop API abuse, and when audit mode is lying to you.
Read article →Trivy Operator vs CI Image Scanning
CI image scans miss cluster drift; Trivy Operator misses the build. When the two overlap, how to dedupe CVEs, and when running both is the right call.
Read article →
Compliance
SOC 2, PCI, HIPAA, CIS benchmarks, and regulatory frameworks.
CSA STAR Cloud Security: CCM Evidence Without a Spreadsheet Theater
Map CSA STAR (CAIQ, Level 1–2, CCM) to AWS, Azure, and GCP controls you already run—and use attack-path evidence so auditors see reachable risk, not screenshot binders.
Read article →
Identity & access
CIEM, IAM, SSO, privileged access, and federation.
A Cloud Security Exception Process That Expires
A cloud security exception process with owners, expiry, and compensating controls—time-boxed IAM and security groups, plus Policy exemptions that actually end.
Read article →Blast Radius Analysis for Cloud IAM Roles
Walk blast radius for one AWS IAM role and one Azure managed identity: define admin-equivalent, then shrink that radius before you patch CVEs.
Read article →CIEM Explained for Cloud Teams: Identity Is the Attack Path
What is CIEM (Cloud Infrastructure Entitlement Management)? Learn how cloud identity entitlement management fits into CNAPP, CSPM, and attack path analysis.
Read article →Cross-Cloud Identity Impersonation (AWS↔GCP↔Azure)
Cross-cloud identity impersonation: federation trust as a graph edge, confused-deputy conditions, workload identity across AWS, GCP, and Azure.
Read article →CSPM vs CIEM vs CNAPP: Three Questions, Three Tools
CSPM, CIEM, and CNAPP answer three different questions. Use this one-page decision table to stop double-ticketing and choose buy versus compose.
Read article →Detecting Shadow Admins in AWS, Azure, and GCP
Shadow admins are not in the Admin group. Hunt AWS PassRole, Azure Owner/UAA, and GCP setIamPolicy with effective-permission queries, not role-name filters.
Read article →DSPM vs CIEM: Data Location vs Who Can Read It
DSPM vs CIEM splits classification of data from classification of principals. Empty public buckets, private buckets with Owner ACL, and IAM that ignores data tags are different failures.
Read article →GitHub Actions OIDC to AWS IAM (No Long-Lived Keys)
GitHub Actions OIDC to AWS: trust policy sub and aud conditions, environment protection, wildcard subject claims, and how to debug InvalidIdentityToken.
Read article →How to Break a Cloud Attack Path (Without Patching Everything)
Break a cloud attack path by cutting the cheapest edge—network, identity, or exposure—then prove the path is gone without a production outage.
Read article →ITDR in the Cloud: Detecting Identity Attacks on IAM
ITDR cloud identity is runtime detection of stolen roles and tokens—not CIEM hygiene. CloudTrail signals that beat impossible travel, AssumeRole theft patterns, and wiring alerts to blast radius.
Read article →Zero Trust Cloud Architecture: Identity, Micro-Segmentation, and Verification
Validate cloud zero trust against live reachability: identity-aware ingress, default-deny east-west, no VPN-as-trust, and graph queries that show where the design leaks.
Read article →
DevSecOps
IaC scanning, CI/CD security, SBOM, and supply chain.
in-toto and SLSA for Cloud CI Builds
in-toto attestations versus Cosign signatures, GitHub SLSA 2 vs 3, admission verification, and the gaps that still let a signed-but-wrong image run.
Read article →OpenTofu vs Terraform for Security Teams
OpenTofu vs Terraform for security: MPL versus BSL, signed providers and lockfiles, state compatibility, and which policy-as-code options survive the fork.
Read article →
Strategy & guides
Architecture, governance, zero trust, and program building.
Pulumi CrossGuard Policies for Cloud Guardrails
Write Pulumi CrossGuard packs that deny public IPs at preview, how they differ from Gatekeeper, and how to run them in CI without a second OPA tutorial.
Read article →Security Graph vs CMDB: Why Inventory Is Not Risk
Why a CMDB is inventory rather than risk: edges it omits, sync lag as a security bug, and when you still need a CMDB beside a security graph.
Read article →Toxic Combinations in AWS and Azure: When Low-Risk Findings Become Critical
Learn what toxic combination cloud security means in AWS and Azure — misconfiguration pairs that create real attack paths, and how security graphs detect them.
Read article →What a Cloud Security Graph Is (and Is Not)
The cloud security graph data model: nodes and edges in practice, queries that replace spreadsheet sorts, and what OpenSourceOM will not model.
Read article →
No articles match your search. Try a different keyword or clear filters.