Ideas, Observations & Stories in Cybersecurity
Why Security Policies Belong in Code — Not Documents Security policies have traditionally lived in documents — PDFs, wikis, and runbooks that describe what should happen. Engineers read them sometimes, interpret them inconsistently, and implement them manually. The gap between documented policy and enforced reality is exactly where breaches are born. Security as Code closes…
The Pattern Has Been Here Before When AWS made servers cheap, everyone became a cloud startup. When no-code tools made apps cheap, everyone became a founder. Now AI has made writing software cheap — and everyone has become an open source maintainer. The result is the fastest expansion of GitHub repositories in its history. Most…
Why NVD Lies to OT Engineers — And the Tool Built to Fix It There is a question every OT security engineer has asked at least once, usually at 11pm after a vendor advisory lands in their inbox. “This CVE is a 10.0. But what does that actually mean for my plant?” The answer NVD…
Every New Attack Surface Arrives Before the Tooling Does SQL injection was being exploited in production years before parameterised queries became standard. Cross-site scripting tore through the early web while developers were still debating whether it was really a vulnerability. Insecure deserialization, XXE, SSRF — each one went through the same cycle: technique emerges, attackers…
Introduction If you’ve been reading this series, you’ve heard both terms. They get used interchangeably in the press, in vendor marketing, and honestly, in a lot of engineering slack channels. But jailbreaking and prompt injection are not the same thing — and conflating them leads to defenses that protect against one while leaving you completely…
Introduction If you’ve followed this series from the beginning, you’ve seen the full attack landscape: direct prompt injection, indirect injection through RAG pipelines, and multi-agent cascades where a single poisoned document can ripple across an entire agent network. Each post ended with defenses specific to that attack. But defenses in isolation don’t make a security…
