This is a personal blog and all content herein is my own opinion and not that of my employer. Background Continuous Access Evaluation, or CAE, is one of those security controls with a wonderfully descriptive name. Access is not supposed to be evaluated only when you first authenticate. It is …

This is a personal blog and all content herein is my own opinion and not that of my employer. Introduction Sometimes security research starts with an exploit. Sometimes it starts with a much more boring question: “Where is the actual security boundary?” This one started with the latter. …

Hero image generated by ChatGPT This is a personal blog and all content herein is my personal opinion and not that of my employer. This is Part 3 of a 3-part series. Part Title Part 1 The Leak, the Context, and the Framework Part 2 Mapping the Trust Boundaries and the Attack Tree Part 3 (this post) …

Hero image generated by ChatGPT This is a personal blog and all content herein is my personal opinion and not that of my employer. This is Part 2 of a 3-part series. Part Title Part 1 The Leak, the Context, and the Framework Part 2 (this post) Mapping the Trust Boundaries and the Attack Tree Part 3 …

Hero image generated by ChatGPT This is a personal blog and all content herein is my personal opinion and not that of my employer. The Procurement TL;DR If you are buying or integrating an AI Agent platform today, ignore the “magic” demos. Ask these three questions: How is my identity …

This is a personal blog and all content herein is my own opinion and not that of my employer. OID-See v1.1.0 is out v1.0.1 tightened the scoring. v1.1.0 expands what OID-See can actually see. This is the biggest release since the initial drop: a new external identity posture surface, a fully …