Blog
Notes from the people doing the work.
Practical writing on AI security, offensive security, exposure management and compliance. No vendor fluff.
Articles
5 articles
- AI security
AI agents and MCP: securing the tools your models can call
Agents turn text into actions. The Model Context Protocol makes connecting tools easy, which moves the real attack surface to tool permissions, tokens and the servers you install.
· 11 min read
Read - AI security
Securing LLM applications: a threat model that fits on one page
Prompt injection is not a bug you patch once. Treat the model as an untrusted component and design the controls around what it can reach.
· 3 min read
Read - Exposure management
CTEM in practice: from vulnerability lists to exposure decisions
More scanners produce more rows. Continuous Threat Exposure Management turns findings into a repeating cycle that ends in fixes.
· 2 min read
Read - Compliance
SOC 2 readiness: where first audits stall
Most first SOC 2 audits don't fail on missing policies. They stall on evidence that controls actually ran during the review period.
· 2 min read
Read - Application security
API security starts with authorization, not the gateway
The most damaging API bugs need no exploit, just a valid token and someone else's object ID. Fix authorization first.
· 2 min read
Read
Newsletter
New research, once a month.
Articles, guides and practical notes from our analysts. No spam; unsubscribe by replying.