Security Researcher • Author • Builder • MVP

Graham.

Cloud security engineer, identity nerd, and researcher.

I break down how systems really work - building tools, writing deep dives, and turning complex security problems into something people can actually use.

Read the Tech Blog View Projects & Research

Research & Project

OID-See

BloodHound for OAuth in Entra ID — maps third-party app consent, scopes, assignments, and trust signals into a graph to surface impersonation risk and OAuth sprawl.

Tech Feb 2026

Synthetic Authority and Constrained Probabilism: What Overloaded Minds Teach Us About AI

From Milgram to cognitive overload to modern agent systems, none of this is new. We are rediscovering decades of psychology the hard way - at machine speed.

Tech Feb 2026

MCP, Latency, and Constrained Probabilism

MCP doesn’t fail because of network latency. It struggles because of semantic latency, context rot, retries, and probabilistic drift. This post explores why, when MCP fits, when it doesn’t, and why Recursive Language Models may change the equation.

Tech Feb 2026

Capability ≠ Obligation: When Agentic Systems Start Hiring Humans

Agentic AI systems that can directly commission humans for real‑world tasks represent a qualitative shift in risk. This is not about hype or Hollywood. It is about incentives, accountability, abuse, and physical safety.

Tech Jan 2026

From Clawdbot to GAINet: When Agent Experiments Outrun Accountability

From Clawdbot to GAINet: When Agent Experiments Outrun Accountability This post didn’t start as a philosophical musing about AI. It started …

Tech Jan 2026

Allowing ARM for Dev Box: When Portals Impersonate Users (and How to Avoid It)

Microsoft recommends allowing the Azure Service Management API from BYOD to enable Dev Box access. That guidance quietly expands the blast radius far beyond Dev Box itself. This post walks through why that happens, what’s really going on at runtime, and an undocumented deep-link that avoids the problem entirely.

Tech Jan 2026

OID-See v1.0.1: Small Release, Sharper Edges

OID-See v1.0.1 tightens scoring logic, improves accuracy around app role assignments, ownership, and deception signals, and lays the groundwork for more trustworthy Entra ID app risk analysis.

🔬

OID-See

BloodHound for OAuth in Entra ID — maps third-party app consent, scopes, assignments, and trust signals into a graph to surface impersonation risk and OAuth sprawl.

GitHub

🔬

ISDF — Intune Stateful Device Fingerprinting

Cloud-stamped device metadata for Conditional Access — moves device trust out of the endpoint and into Azure, using TPM-rooted hardware identifiers validated by a Logic App with Managed Identity.

GitHub

🔬

KuShu — Attack & Defence Research

KuShuSec is a collection of cloud security attack and defence research, tools, and mind maps — including the KuShu-Atama attack/defence mind map repository and SPADE research.

GitHub

🔬

Az-Skywalker

A collection of Azure security research tools exposing control plane isolation flaws, cross-plane data exposure, and silent data harvesting in Microsoft Azure iPaaS services.

GitHub