Blog

Browse by topic, filter by tag, or search by keyword.

CNAPP & CSPM

Posture management, attack paths, exposure, and prioritization.

Agentless vs Agent: What Snapshots Miss at Runtime

API snapshots see IAM and exposure; agents see processes and ransomware. Blind spots of both, and a hybrid that does not double-ticket every CVE.
Read article →
Architecture of a Self-Hosted CSPM

How a self-hosted CSPM is built: collectors and credentials, the graph store, the policy engine, and multi-tenant isolation—not a recap of which scanner to buy.
Read article →
ASPM vs CNAPP: Application Posture vs Cloud Posture

ASPM vs CNAPP is not two names for the same platform. ASPM inventories apps, APIs, and code risk; CNAPP inventories cloud resources and IAM. Shared runtime is where the queues collide.
Read article →
Attack Path Analysis in Cloud Security: A Practical Guide

Learn what attack path analysis is, how cloud attack paths are modeled in a security graph, and why graph-native CNAPP tools prioritize reachable risk over flat alert lists.
Read article →
Cloud Detection and Response (CDR) vs CSPM

CDR versus CSPM: state versus events, the telemetry you actually need, detections that require graph context, and where GuardDuty, SCC, and Defender fit.
Read article →
Cloud Security KPIs Boards Actually Understand

Board-ready cloud security KPIs: stop reporting raw criticals, track internet-facing count, path-open time, exception age, and a sample monthly pack.
Read article →
CSPM vs CNAPP: What's the Difference (and Why the Security Graph Matters)

Compare CSPM vs CNAPP for cloud security. Learn how attack path analysis and security graphs help teams prioritize misconfigurations and vulnerabilities that attackers can actually reach.
Read article →
How to Prioritize Cloud Vulnerabilities When Everything Is "Critical"

A practitioner guide to cloud vulnerability prioritization beyond CVSS — using exposure, attack paths, and asset context to fix what attackers can actually exploit.
Read article →
Open Source CSPM and CNAPP Tools in 2026: What Exists Today

Survey of open source CSPM, self-hosted CNAPP alternatives, and graph-native cloud security tools in 2026 — plus how to evaluate self-hosted options for your team.
Read article →
Reachable Risk: Ranking Cloud Findings by Attack Path

Rank cloud findings by reachable risk: network plus identity paths, why private subnets lie, and ticket text that includes the actual attack path.
Read article →

AWS

IAM, S3, EKS, GuardDuty, and AWS service hardening guides.

Amazon CloudFront Security: OAC, TLS, and Origin Lockdown

Amazon CloudFront security that actually holds: Origin Access Control instead of OAI, HTTPS only, S3 bucket policies that deny non-CloudFront, WAF attachment, and the bypass of hitting the bucket URL directly.
Read article →
Amazon DocumentDB Security Hardening: TLS, IAM, and No Public 27017

Harden Amazon DocumentDB with TLS 1.2, encryption at rest, no public access, scoped IAM or secrets, audit logs, and snapshot controls—then verify no internet path to the cluster.
Read article →
Amazon EventBridge Security: Bus Policies and API Destinations

Amazon EventBridge security: default-bus vs custom bus resource policies, cross-account PutEvents, API destinations and connection secrets, and encryption that does not cover the event you already leaked to a partner.
Read article →
Amazon RDS Security: Encryption, IAM Auth, and Public Access

Lock down Amazon RDS: KMS at rest, TLS in transit, IAM database auth, PubliclyAccessible false, snapshot exposure, and the security-group mistakes that still publish Postgres to 0.0.0.0/0.
Read article →
Amazon SageMaker Security for ML Workloads in Production

Lock down SageMaker Studio, training jobs, and endpoints: VPC-only, scoped execution roles, no root on notebooks, encrypted data, and private model APIs.
Read article →
Amazon Verified Permissions and Cedar for App AuthZ

Amazon Verified Permissions Cedar is application authorization, not IAM and not CSPM. Policy shape, when AVP is the wrong tool, and mapping API actions to the same identities a security graph already has.
Read article →
AWS Control Tower Detective Guardrails That Matter

Control Tower detective guardrails are Config rules, not SCPs. Skip duplicates of preventive policies, fix recorder ownership, and map remaining noncompliant resources onto attack paths.
Read article →
AWS Data Perimeter: Which Policy Does Which Deny

AWS data perimeter means three different denies: other orgs on your resources, your callers off your network, and your callers on other orgs' resources.
Read article →
AWS Glue Security: Job Roles, Catalog Encryption, and Connections

AWS Glue security for ETL: least-privilege job roles, Lake Formation vs IAM, connection credentials, catalog encryption, and why a crawler role that can s3:* is an exfil path.
Read article →
AWS Lambda Security: Execution Roles, Resource Policies, and Function URLs

AWS Lambda security that matters in prod: execution-role blast radius, resource-based policies, Function URL auth, public layers, and env vars that are still plaintext secrets.
Read article →
AWS Resource Control Policies (RCPs) vs SCPs

AWS resource control policies are Organizations resource-based guardrails: they cap what any caller—including principals outside the org—can do to member-account resources. SCP vs RCP vs IAM, a public-S3 deny, sandbox OU tests.
Read article →
AWS S3 Bucket Security Hardening: Block Public Access and Beyond

Harden AWS S3 with account-level Block Public Access, bucket policies over ACLs, KMS encryption, VPC endpoints, and Access Analyzer—then rank leftover risk by attack path.
Read article →
AWS Security Best Practices: A Practitioner Checklist for 2026

Org-first AWS hardening: Identity Center over access keys, SCPs that actually deny, org CloudTrail, S3 Block Public Access, and the failure modes that keep those controls from working.
Read article →
CloudFormation Hooks as Preventive Guardrails

CloudFormation Hooks versus Config and SCPs: a deny-public-S3 hook on create, the IAM role the hook runs as, and the failure modes that fail open.
Read article →
EC2 Instance Connect Endpoint: Private SSH Without a Bastion

EC2 Instance Connect Endpoint is private SSH: OpenTunnel IAM, the endpoint security group as source, and when Session Manager is the better control.
Read article →
IAM Access Analyzer Unused Access in Organizations

IAM Access Analyzer unused access is a paid org analyzer, not the free external-access findings. Delegated admin, service-linked noise, tracking-period traps, and turning findings into permission boundaries.
Read article →
IAM Permission Boundaries Are a Ceiling, Not a Grant

An IAM permission boundary is the maximum a role can have. It grants nothing. Condition CreateRole on it, and deny deleting the boundary.
Read article →
IAM Roles Anywhere: Certificates Instead of Access Keys

IAM Roles Anywhere exchanges an X.509 certificate for short-lived STS credentials. Trust anchors, CN conditions, and revoked certs that still work.
Read article →
Multi-Account AWS Attack Paths: Trust Policies and SCPs

How AssumeRole, resource policies, and SCPs create org-wide AWS attack paths, including trusts and denies that do not apply where you think.
Read article →
Public EBS Snapshots: Finding and Killing Them

Public EBS snapshot exposure is CreateVolumePermission group=all, not a bucket ACL. Account-level block-all-sharing, hunt commands, and the AMI side channel Block Public Access for snapshots does not close.
Read article →
S3 Object Lock: Governance, Compliance, and Delete Markers

S3 Object Lock is a retention ceiling: governance can be bypassed, compliance cannot, and a delete marker hides versions it does not remove.
Read article →
SCP vs RCP Evaluation Order

AWS checks every explicit Deny before RCP and SCP Allows. RCPFullAWSAccess cannot be detached, so an RCP narrows access only with Deny — an identity Allow never skips that.
Read article →
Securing Terraform State in S3

Terraform state in S3 is a secret store: encrypt it, Block Public Access, lock it, and treat s3:GetObject on the state key as production credential access.
Read article →
Stop EC2 SSRF: Require IMDSv2 Hop Limit 1

Hop limit 1 blocks SSRF and container theft of instance-profile keys. CLI, launch templates, account defaults, SCPs, and the hop-limit-2 failure modes.
Read article →
VPC Endpoints vs NAT: Security and Data Paths

VPC endpoint vs NAT gateway security is not a cost conversation. NAT still egresses to public AWS APIs; gateway vs interface endpoints; endpoint policies as IAM; put S3 and STS on private paths first.
Read article →

Azure

Defender, AKS, Key Vault, and Microsoft cloud security.

Azure Application Gateway WAF: OWASP Rules, Tuning, and What WAF Cannot Do

Run Application Gateway WAF_v2 in Prevention with OWASP CRS, custom rules, and Log Analytics—without treating WAF as authentication or network segmentation.
Read article →
Azure Blueprint Locks Are Deny Assignments

Blueprint Read Only and Do Not Delete locks are deny assignments. Microsoft removes those denies on 31 January 2027. Map them onto a deployment stack before then.
Read article →
Azure CSPM Implementation Guide: From Defender to Custom Policies

Turn on Defender for Cloud CSPM at the management group, assign MCSB with Deny, export to Log Analytics, and avoid Secure Score theater and exemption rot.
Read article →
Azure Federated Identity Credentials Instead of Client Secrets

Replace app-registration client secrets in GitHub Actions with Azure federated identity credentials: OIDC issuer, subject, audience, leftover secrets, and az commands.
Read article →
Azure Landing Zone Deny Assignments That Block Owners

CAF-style deny assignments vs Policy Deny, platform vs app landing zones, break-glass, and debugging “I am Owner but cannot delete.”
Read article →
Azure Lighthouse: Cross-Tenant Access Without Guest Users

Azure Lighthouse is cross-tenant RBAC, not a guest user. Eligible authorizations, roles to refuse, and deny assignments that still bind the partner.
Read article →
Azure PIM: Eligible vs Active Roles

Standing Owner is the finding; eligible is still a path. Approval, MFA on activate, Graph/PIM APIs, and how to put eligible edges on a security graph.
Read article →
Azure Private Endpoints: The DNS Gotchas That Re-Expose Services

Private endpoints that still resolve to public IPs: zone linking, split-brain resolvers, missing privatelink zones, and Storage/Key Vault examples you can query.
Read article →
Azure Resource Graph Queries for Security Review

Use Azure Resource Graph KQL for public IPs and open NSGs at management-group scope, when ARG beats Policy, and how to export hits into a security graph.
Read article →

Google Cloud

GKE, IAM, VPC Service Controls, and GCP posture management.

GCP IAM Deny Overrides Allow: Stop Key Creation

Deny evaluates after the allow union—even Owner. Attachment points, a key-creation deny you can test, lockout paths, and exceptions that do not become standing admin.
Read article →
GCP IAM Security Hardening: Roles, Conditions, and Service Accounts

Stop using basic roles and JSON keys: folder inheritance, IAM deny policies, organization constraints, Workload Identity Federation, and the default Compute SA.
Read article →
GCP Principal Access Boundaries Explained

Principal Access Boundary policies cap which resources a principal can touch: PAB vs IAM deny vs org policy, a contractor example, and how to test before binding.
Read article →
GCP Workforce Identity Federation for Human SSO

Workforce Identity Federation maps IdP groups to GCP IAM for humans—no Cloud Identity user required. Not Workload Identity Federation (that is CI and GKE).
Read article →
GitLab CI to GCP with Workload Identity Federation

GitLab CI Workload Identity Federation: attribute mapping, protected branches, leftover JSON keys, and when Cloud Build is the better runner than GitLab.
Read article →
GKE Autopilot Security Trade-offs vs Standard

What GKE Autopilot actually locks (nodes, privileged, hostPath) versus what you still own: IAM, images, Workload Identity, and the cases where Standard is the only honest choice.
Read article →
Google Cloud Armor WAF Rules and DDoS Protection

Set up Cloud Armor on a Google Cloud load balancer: L3/L4 DDoS, preconfigured OWASP WAF rules, rate limiting, Adaptive Protection, Terraform, and preview mode.
Read article →
VPC Service Controls: Dry-Run Then Enforce

Operator sequence for VPC Service Controls: perimeter vs IAM, dry-run logs, Cloud Build false positives, then a staged enforce. This is not a WAF.
Read article →
Write a GCP Custom Org Policy Constraint in CEL

Custom CEL constraints when IAM cannot express a resource-shape rule. Dry-run, managed vs custom, and the failure modes that silently skip evaluation.
Read article →

Kubernetes

RBAC, network policies, admission control, and cluster security.

Cloud-Native Application Security: Design Patterns for Secure Apps

Seven design patterns for securing cloud-native apps on Kubernetes and serverless—supply chain, identity, network, secrets, APIs, runtime, and attack-path context.
Read article →
Cosign Keyless Signing and Admission on Kubernetes

Cosign keyless signing with Fulcio and Rekor, admission via Kyverno or VAP, and the air-gap limits that force you back to keys on Kubernetes.
Read article →
EKS Pod Identity vs IRSA

EKS Pod Identity binds an IAM role to a namespace and service account. Trust policy, leftover IRSA annotations, and an agent that fails closed.
Read article →
From Compromised Pod to Cloud Admin: The IRSA/WI Path

Trace the IRSA and Workload Identity path from a compromised pod to cloud admin, then break that path at the annotation before the cloud role.
Read article →
Image Provenance and SLSA on Kubernetes

SLSA levels that actually ship in production Kubernetes: Cosign attestations at admission, why a CVE scan is not provenance, and how to kill :latest.
Read article →
IRSA Trust Policy aud Mistakes

The IRSA aud claim is sts.amazonaws.com and does not name the cluster. Wrong condition keys, a second audience on the OIDC provider, and a trust policy that only checks sub.
Read article →
KSPM Explained: Kubernetes Security Posture Beyond CIS YAML

KSPM beyond CIS YAML: cluster config versus workload identity, connecting findings to cloud IAM, and where admission control differs from scans.
Read article →
Kubernetes Ephemeral Containers and kubectl debug

kubectl debug patches pods/ephemeralcontainers, which many Pod CREATE policies never see. RBAC, node debug pods, and the shared process namespace.
Read article →
Kubernetes Projected Service Account Token Volumes

Replace never-expiring Secret-based service account tokens with TokenRequest projected volumes: audiences, expiry, pod-bound tokens, and how IRSA consumes them.
Read article →
Kubernetes RBAC Security Best Practices for Production Clusters

Production Kubernetes RBAC: namespace Roles not cluster-admin, automount off, bound tokens, aws-auth vs access entries, and kubectl-who-can in CI.
Read article →
Kubernetes User Namespaces (hostUsers: false)

Kubernetes user namespaces set hostUsers false so container root is not host root. On by default since 1.33, and why hostPath and seccomp still matter.
Read article →
Kubernetes ValidatingAdmissionPolicy: CEL vs Webhooks

In-process CEL for deny-only checks; keep Kyverno or Gatekeeper for mutation. FailurePolicy Fail vs Ignore, parameter resources, and 1.30+ GA.
Read article →
Kyverno vs ValidatingAdmissionPolicy

ValidatingAdmissionPolicy denies object shape in-process. Kyverno still generates objects, verifies images, and reports on resources that already exist. Do not run both on the same rule.
Read article →
Seccomp and AppArmor for Kubernetes Workloads

RuntimeDefault seccomp and AppArmor annotations for Kubernetes: what syscalls they block, why they do not stop API abuse, and when audit mode is lying to you.
Read article →
Trivy Operator vs CI Image Scanning

CI image scans miss cluster drift; Trivy Operator misses the build. When the two overlap, how to dedupe CVEs, and when running both is the right call.
Read article →

Compliance

SOC 2, PCI, HIPAA, CIS benchmarks, and regulatory frameworks.

CSA STAR Cloud Security: CCM Evidence Without a Spreadsheet Theater

Map CSA STAR (CAIQ, Level 1–2, CCM) to AWS, Azure, and GCP controls you already run—and use attack-path evidence so auditors see reachable risk, not screenshot binders.
Read article →

Identity & access

CIEM, IAM, SSO, privileged access, and federation.

A Cloud Security Exception Process That Expires

A cloud security exception process with owners, expiry, and compensating controls—time-boxed IAM and security groups, plus Policy exemptions that actually end.
Read article →
Blast Radius Analysis for Cloud IAM Roles

Walk blast radius for one AWS IAM role and one Azure managed identity: define admin-equivalent, then shrink that radius before you patch CVEs.
Read article →
CIEM Explained for Cloud Teams: Identity Is the Attack Path

What is CIEM (Cloud Infrastructure Entitlement Management)? Learn how cloud identity entitlement management fits into CNAPP, CSPM, and attack path analysis.
Read article →
Cross-Cloud Identity Impersonation (AWS↔GCP↔Azure)

Cross-cloud identity impersonation: federation trust as a graph edge, confused-deputy conditions, workload identity across AWS, GCP, and Azure.
Read article →
CSPM vs CIEM vs CNAPP: Three Questions, Three Tools

CSPM, CIEM, and CNAPP answer three different questions. Use this one-page decision table to stop double-ticketing and choose buy versus compose.
Read article →
Detecting Shadow Admins in AWS, Azure, and GCP

Shadow admins are not in the Admin group. Hunt AWS PassRole, Azure Owner/UAA, and GCP setIamPolicy with effective-permission queries, not role-name filters.
Read article →
DSPM vs CIEM: Data Location vs Who Can Read It

DSPM vs CIEM splits classification of data from classification of principals. Empty public buckets, private buckets with Owner ACL, and IAM that ignores data tags are different failures.
Read article →
GitHub Actions OIDC to AWS IAM (No Long-Lived Keys)

GitHub Actions OIDC to AWS: trust policy sub and aud conditions, environment protection, wildcard subject claims, and how to debug InvalidIdentityToken.
Read article →
How to Break a Cloud Attack Path (Without Patching Everything)

Break a cloud attack path by cutting the cheapest edge—network, identity, or exposure—then prove the path is gone without a production outage.
Read article →
ITDR in the Cloud: Detecting Identity Attacks on IAM

ITDR cloud identity is runtime detection of stolen roles and tokens—not CIEM hygiene. CloudTrail signals that beat impossible travel, AssumeRole theft patterns, and wiring alerts to blast radius.
Read article →
Zero Trust Cloud Architecture: Identity, Micro-Segmentation, and Verification

Validate cloud zero trust against live reachability: identity-aware ingress, default-deny east-west, no VPN-as-trust, and graph queries that show where the design leaks.
Read article →

DevSecOps

IaC scanning, CI/CD security, SBOM, and supply chain.

GitLab CI OIDC to AWS IAM

GitLab CI OIDC to AWS uses project_path and ref in sub, not a GitHub-style repo claim. Protect prod with ref_protected and a narrow StringEquals.
Read article →
in-toto and SLSA for Cloud CI Builds

in-toto attestations versus Cosign signatures, GitHub SLSA 2 vs 3, admission verification, and the gaps that still let a signed-but-wrong image run.
Read article →
OpenTofu vs Terraform for Security Teams

OpenTofu vs Terraform for security: MPL versus BSL, signed providers and lockfiles, state compatibility, and which policy-as-code options survive the fork.
Read article →

Strategy & guides

Architecture, governance, zero trust, and program building.

Pulumi CrossGuard Policies for Cloud Guardrails

Write Pulumi CrossGuard packs that deny public IPs at preview, how they differ from Gatekeeper, and how to run them in CI without a second OPA tutorial.
Read article →
Security Graph vs CMDB: Why Inventory Is Not Risk

Why a CMDB is inventory rather than risk: edges it omits, sync lag as a security bug, and when you still need a CMDB beside a security graph.
Read article →
Toxic Combinations in AWS and Azure: When Low-Risk Findings Become Critical

Learn what toxic combination cloud security means in AWS and Azure — misconfiguration pairs that create real attack paths, and how security graphs detect them.
Read article →
What a Cloud Security Graph Is (and Is Not)

The cloud security graph data model: nodes and edges in practice, queries that replace spreadsheet sorts, and what OpenSourceOM will not model.
Read article →