RESEARCH / BLOG
Research on how real attack paths actually emerge.
Not another feed of “what is X?” posts. Experiments, exploit-chain postmortems, benchmarks, control failures and reproducible research across software, infrastructure, identity and security controls.
Your Repository Is Executable Input Now
Coding agents changed the repository threat model: configuration, hooks, instructions and tool definitions can influence privileged agent behavior.
Read
MCP Is Becoming a Security Boundary. Treat It Like One.
MCP security is not mainly a prompt-filtering problem. Once an agent can call tools with real credentials, the useful threat model is identity + authorization + untrusted input + execution.
Read
Cloud Context Is Not Enough: Security Testing Needs the Organization's DNA
Real attack paths cross code, identity, infrastructure, controls and organization-specific rules. Product security needs a full-system model.
Read
The AI Pentest Race Is Becoming an Exploit-Proof Race
Autonomous offensive security is attracting serious capital. The durable product is not another alert generator---it is defensible exploit evidence and re-test.
Read