I tested three approaches to automating security questionnaires with AI: expensive SaaS vendors, custom RAG solutions, and direct LLM use.   #ai   #process

The Google Cloud Threat Horizons Report provides decision-makers with strategic intelligence on threats to not just Google Cloud, but all cloud service providers.   #aws   #azure   #defend   #gcp

A silent attack on Gemini CLI where, through a toxic combination of prompt injection, misleading UX and missing validation, inspecting untrusted code consistently leads to execution of malicious commands.   #ai   #attack   #defend

This article explores building an AI agent for AWS GuardDuty alert triage using PydanticAI, demonstrating how LLMs can assist in security automation while maintaining human oversight for alert assessment.   #ai   #aws   #monitor

Discover critical AWS Managed Active Directory security vulnerabilities enabling RBCD attacks via ms-ds-MachineAccountQuota. Learn mitigation strategies and detection methods for AWS Directory Service environments.   #aws   #attack   #defend   #iam

Deep-dive into a privilege escalation path in AWS's new Bedrock AgentCore tooling, specifically the Code Interpreters used by AI agents.   #ai   #attack   #aws   #iam

This article discusses Netflix's "Psycho Pattern" - a hybrid batch/real-time pipeline for threat detection.   #design   #monitor

Mini-series to discuss the similarities and differences of AWS Cloud vs. on-premises investigations, starting with the AWS EC2 service.   #attack   #aws   #defend

New discovery underscores security implications of AI-powered development and the rise of Vibe Coding Platforms.   #ai   #attack   #defend   #saas

PowerShell collector for adding MSSQL attack paths to BloodHound with OpenGraph.

A secure, scalable GitHub Actions runner platform for ephemeral workloads. Designed for multi-tenant environments, it automates isolated runner provisioning on Kubernetes or EC2, with built-in OIDC, IAM, cost optimization, and deep observability.

A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a json based rules engine.

A tool intended to facilitate the exploration of Oracle database DB Links. You can also refer to the companion blog post.

Veles is a standalone library for secret scanning that ships as part of Scalibr. It can detect and (where possible) validate credentials and other things colloquially referred to as "secrets". You can also refer to the companion blog post.

This post addresses scenarios where, for example, you have a web server that uses a Microsoft Active Directory user account (service account) to access an application or database resources on other servers, and you want to automate disabling the user account if suspicious activity is detected.

A real-world scenario to show how AWS Security Incident Response can immediately generate benefits by accelerating every step of your incident response lifecycle, and how it integrates with other native AWS services.

This article announces three security enhancements for Google Workspace: passkeys general availability, Device Bound Session Credentials (DBSC) beta, and upcoming shared signals framework receiver to combat account takeovers and credential theft.