Asyraf
Security engineer in Singapore
I help teams understand a security problem, then build the thing that shows how to solve it. Identity, AI agents, vulnerability risk, and regulation, explained for the people who have to decide.
Start here
CVE, CVSS, EPSS, KEV: The Vulnerability Alphabet, Finally Explained
Explaining a technical system to people who are not security engineers.
Your Org Is Hiring Workers You Can't See: An Identity Playbook for AI Agents
Turning a new risk into a concrete, step-by-step solution design.
MAS TRM Without a Compliance Department: What the Guidelines Actually Ask of a Small Team
Reading regulation the way a Singapore buyer has to.
The Blog Watches the Watchers: Building a Threat-Intel Page With No Servers
Building a working system end to end, and showing how it holds up.
Live demos
All demosSecurity Feeds Pipeline
For security teams without a threat-intel budget
A self-updating threat-intelligence page: around twenty sources (CISA KEV, NVD, GitHub Advisories, abuse.ch, malware news, AI-security research) normalised into one view and scored by a deterministic KEV/CVSS/EPSS risk engine. No servers, no database.
Vendor Breach Watch
For GRC and third-party risk owners
A supplier watchlist checked twice a day against public breach and incident sources. A match opens one deduplicated GitHub issue with source links and a remediation checklist, so 'is any vendor of ours in the news?' gets answered automatically.
Password Exposure Checker
For teams explaining credential risk to non-technical staff
Check whether a password has appeared in known breaches without the password, or even its full hash, ever leaving the browser. Built to be shown, not just used: the page explains exactly what is sent and why that is safe.
Latest writing
All writingMAS TRM Without a Compliance Department: What the Guidelines Actually Ask of a Small Team
18/10/2026
Singapore's MAS Technology Risk Management guidelines read like they were written for banks with committees. Underneath the governance language is a checklist a ten-person team can genuinely run.
Putting AI on the Blue Team: Where Claude, Codex, and Gemini Actually Earn Their Keep in Defence
03/10/2026
Frontier AI assistants are marketed as security multipliers. Some of that is real. Here's where they genuinely help a defender today, how to choose between them, and the guardrails that keep your defender from becoming your incident.
Stop Patching by CVSS Alone: A Three-Signal Triage Formula That Fits on a Sticky Note
26/09/2026
CVSS tells you how bad a vulnerability could be, EPSS tells you how likely exploitation is, and KEV tells you it's already happening. Used together, they turn the CVE firehose into a defensible patch queue.