Security Researcher • Author • Builder • MVP

Graham.

Cloud security engineer, identity nerd, and researcher.

I break down how systems really work - building tools, writing deep dives, and turning complex security problems into something people can actually use.

Read the Tech Blog View Projects & Research

Research & Project

OID-See

BloodHound for OAuth in Entra ID — maps third-party app consent, scopes, assignments, and trust signals into a graph to surface impersonation risk and OAuth sprawl.

Official merchandise

Security With Attitude.

Least privilege. Maximum judgement. Cloud security, questionable cows and production-grade sarcasm. The official CirriusTech merchandise collection.

Explore the Merch

Tech Oct 2026

The Bigger the Judge, the Better the Judgment? Not Quite.

I tested three sizes of Kev and hosted JEV against security evidence, reordered choices, reassuring text and claims of authority. Bigger models were more stable, but that wasn't the whole story. And the results sent me down another architectural rabbit hole.

Tech Oct 2026

"High Confidence" Is Not a Security Control

JEV is fast, cheap and surprisingly capable. But recent research into its decision logic raises a bigger question: what happens when probabilistic AI judgment becomes an automated security control?

Tech Sep 2026

'A Human Should Check It' is Not an Agentic Security Control

MSRC assessed an indirect prompt injection into Security Copilot as Low severity because consequential action still required downstream automation or human approval. That rationale gets much more interesting once security systems are explicitly designed to perceive, reason, and act autonomously.

Tech Sep 2026

Continuous Access Evaluation: Is it really tho?

An investigation into Outlook Mobile continuing to access Exchange Online mailbox data after Conditional Access and Continuous Access Evaluation say the session should no longer be authorised.

Tech Sep 2026

Daddy Issues: When APIM Workspaces Inherit the Parent Identity

How a dedicated Azure API Management Workspace Gateway can still use the managed identity of its parent APIM service.

Tech Aug 2026

What The Entra Fudge?! Tenant Restrictions v1 Doesn't Mean What You Think It Means

Tenant Restrictions v1 can block access to unapproved Entra tenants while still allowing Microsoft consumer accounts unless a second header is injected into a different authentication endpoint.