A little while ago I demonstrated something fairly simple. An attacker-controlled HTTP User-Agent value was ingested into Microsoft Sentinel as part of normal security telemetry. Security Copilot then consumed that telemetry while analysing the incident. The User-Agent contained an indirect prompt …

This is a personal blog and all content herein is my own opinion and not that of my employer. Background Continuous Access Evaluation, or CAE, is one of those security controls with a wonderfully descriptive name. Access is not supposed to be evaluated only when you first authenticate. It is …

This is a personal blog and all content herein is my own opinion and not that of my employer. Introduction Sometimes security research starts with an exploit. Sometimes it starts with a much more boring question: “Where is the actual security boundary?” This one started with the latter. …

Hero image generated by ChatGPT This is a personal blog and all content herein is my own opinion and not that of my employer. Background Microsoft Edge introduced Drop as part of its sidebar ecosystem as a quick, frictionless way to share notes and files between signed-in devices using OneDrive …