This is a personal blog and all content herein is my own opinion and not that of my employer. Background Continuous Access Evaluation, or CAE, is one of those security controls with a wonderfully descriptive name. Access is not supposed to be evaluated only when you first authenticate. It is …

This is a personal blog and all content herein is my own opinion and not that of my employer. Introduction Sometimes security research starts with an exploit. Sometimes it starts with a much more boring question: “Where is the actual security boundary?” This one started with the latter. …

This is a personal blog. All opinions are my own - not my employer’s. There’s apparently a new category of security incident called AI escape. Except there isn’t. That phrase might be useful shorthand for headlines, and some of the incidents behind it are genuinely serious, but I think …

m365-graph-schema-monitor helps track Graph API shape changes over time by acquiring metadata snapshots and comparing CSDL definitions between versions. What it does Captures and stores Graph metadata snapshots Parses entity and type definitions from CSDL Diffs schema changes and renders reviewable …

Somewhere Over Europe Some ideas arrive fully formed. Others sort of… leak in. This one started somewhere between Beijing and Stockholm, half-rewatching Inception on a plane, half-asleep, and very much not trying to have any original thoughts. There’s a scene in that film about dream architecture. …

Hero image generated by ChatGPT This is a personal blog and all content herein is my personal opinion and not that of my employer. This is Part 3 of a 3-part series. Part Title Part 1 The Leak, the Context, and the Framework Part 2 Mapping the Trust Boundaries and the Attack Tree Part 3 (this post) …