Technical Writing
Tech Blog
Cloud security, identity, infrastructure, and research. Deep dives, tools, and practical guidance.
What The VLAN?! My ASUS Router Has Been Keeping Secrets
I went looking for IoT isolation on an ASUS ZenWiFi XT9 and found tagged guest VLANs, AiMesh spanning tree, and an unexpected trunk on an ordinary LAN port.
The Bigger the Judge, the Better the Judgment? Not Quite.
I tested three sizes of Kev and hosted JEV against security evidence, reordered choices, reassuring text and claims of authority. Bigger models were more stable, but that wasn't the whole story. And the results sent me down another architectural rabbit hole.
"High Confidence" Is Not a Security Control
JEV is fast, cheap and surprisingly capable. But recent research into its decision logic raises a bigger question: what happens when probabilistic AI judgment becomes an automated security control?
'A Human Should Check It' is Not an Agentic Security Control
MSRC assessed an indirect prompt injection into Security Copilot as Low severity because consequential action still required downstream automation or human approval. That rationale gets much more interesting once security systems are explicitly designed to perceive, reason, and act autonomously.
Continuous Access Evaluation: Is it really tho?
An investigation into Outlook Mobile continuing to access Exchange Online mailbox data after Conditional Access and Continuous Access Evaluation say the session should no longer be authorised.
Daddy Issues: When APIM Workspaces Inherit the Parent Identity
How a dedicated Azure API Management Workspace Gateway can still use the managed identity of its parent APIM service.