Technical Writing
Tech Blog
Cloud security, identity, infrastructure, and research. Deep dives, tools, and practical guidance.
The Bigger the Judge, the Better the Judgment? Not Quite.
I tested three sizes of Kev and hosted JEV against security evidence, reordered choices, reassuring text and claims of authority. Bigger models were more stable, but that wasn't the whole story. And the results sent me down another architectural rabbit hole.
"High Confidence" Is Not a Security Control
JEV is fast, cheap and surprisingly capable. But recent research into its decision logic raises a bigger question: what happens when probabilistic AI judgment becomes an automated security control?
'A Human Should Check It' is Not an Agentic Security Control
MSRC assessed an indirect prompt injection into Security Copilot as Low severity because consequential action still required downstream automation or human approval. That rationale gets much more interesting once security systems are explicitly designed to perceive, reason, and act autonomously.
Continuous Access Evaluation: Is it really tho?
An investigation into Outlook Mobile continuing to access Exchange Online mailbox data after Conditional Access and Continuous Access Evaluation say the session should no longer be authorised.
Daddy Issues: When APIM Workspaces Inherit the Parent Identity
How a dedicated Azure API Management Workspace Gateway can still use the managed identity of its parent APIM service.
What The Entra Fudge?! Tenant Restrictions v1 Doesn't Mean What You Think It Means
Tenant Restrictions v1 can block access to unapproved Entra tenants while still allowing Microsoft consumer accounts unless a second header is injected into a different authentication endpoint.