Slack's Security Engineering team built an AI agent system to automate security alert investigations. The system uses multiple agent personas (Director, domain Experts, and Critic) orchestrated through structured outputs, enabling consistent performance and novel emergent discoveries like identifying credential exposures during routine investigations.   #ai   #monitor   #build

Post explaining how misconfigured Account Auto-Link in Okta can break Software-as-a-Service tenant isolation, and how to configure Okta as an Identity Broker in a secure way.   #iam   #saas   #attack   #defend

CVE-2025-55182 is a critical vulnerability in React Server Components allowing remote code execution via crafted requests. Affects Next.js and other frameworks.   #attack   #defend   #supply-chain

Azure API Management exposes managed identity certificates with private keys in plaintext through an undocumented configuration API used by self-hosted gateways. Attackers with gateway keys can extract these certificates for persistent backdoor access.   #azure   #attack

A step-by-step guide on implementing mTLS for Amazon CloudFront using our open-source cloud CA.   #aws   #build

An MCP server and command-line tool that helps your AI coding assistants quickly create baseline IAM policies that you can refine as your application evolves.

Real incidents reproduced with vulnerable/secure MCP servers, pytest regressions, and Claude/Cursor battle-tested exploit walkthroughs.

A simple and secure identity management platform, allowing other applications and services to offload the challenge of authenticating and storing identities to Kanidm.

A tool designed to simplify Kubernetes Infrastructure Entitlement Management by allowing visibility of permissions and their usage across the cluster, to allow for real enforcement of the principle of least privilege.

Codespaces but open-source, client-only and unopinionated: Works with any IDE and lets you use any cloud, kubernetes or just localhost docker.

Mercari's AI Security team built LLM Key Server to provide secure LLM API access using OIDC ID tokens from Google Workspace. It issues temporary API keys via LiteLLM, replacing manual provisioning with automated authentication for local environments, GitHub Actions, and Google Apps Script.

A benchmark on realistic security operations (SecOps) tasks. GPT-5 achieved the highest accuracy (63%), while Claude Haiku-4.5 completed tasks the fastest with strong accuracy. GPT-5 variants dominated the performance-cost frontier.

Run Lambda functions on EC2 compute while maintaining serverless simplicity—enabling access to specialized hardware and cost optimizations through EC2 pricing models, with AWS handling all infrastructure management.

CloudWatch can automatically normalize and process data to offer consistency across sources with built-in support for Open Cybersecurity Schema Framework (OCSF) and Open Telemetry (OTel) formats, so you can focus on analytics and insights.

With VPC Flow Logs, now you can monitor critical network traffic moving between your on-prem infrastructure, cross-cloud resources, and Google Cloud.