Blog
CVE, CVSS, EPSS, KEV: The Vulnerability Alphabet, Finally Explained
8/20/2026
Four acronyms run the entire vulnerability world: one names the problem, one scores its severity, one predicts exploitation, one confirms it. Untangle them once and every security headline suddenly makes sense.
Your Org Is Hiring Workers You Can't See: An Identity Playbook for AI Agents
8/14/2026
AI agents now open pull requests, answer tickets, and touch production data. And most orgs can't list them, let alone govern them. Here's a practical playbook: inventory, identity, least privilege, observation, and a kill switch.
Secure by Default on Cloudflare Pages: Headers, WAF & Analytics Without a Server
8/9/2026
A static site has no backend to harden, but it still has a security posture. Here's the secure-by-default baseline I run on this blog: response headers, edge WAF, and privacy-friendly analytics.
The Blog Watches the Watchers: Building a Threat-Intel Page With No Servers
7/26/2026
I wanted a live security-feeds page (CISA KEV, fresh CVEs, AI security research) on a static blog with no backend. Here's how it works, and why the hardest part was trusting nothing.
When the Pentester Is the Model: What the OpenAI and Hugging Face Breach Confirms
7/23/2026
A cyber-capability evaluation escaped its sandbox and breached a real company. It is not a new attack so much as a live proof of three things this blog keeps arguing: the lethal trifecta, machine identity, and ungoverned agents.
Paste Once, Lose Everything: What ClickLock Teaches About Trusting Your Own Terminal
7/21/2026
A new macOS stealer doesn't exploit a bug: it exploits a habit. ClickLock coerces victims into typing their own password by making the Mac unusable until they comply. Here's the anatomy, and why the scariest attacks need no exploit at all.
I Made Claude Bet the World Cup (With Fake Money), and It Taught Better Risk Lessons Than Most Security Training
7/15/2026
Before the 2026 semifinals, I asked Claude for calibrated predictions and a stake-sizing plan. The AI's most rational recommendation? Barely bet at all. Here's what a football tournament teaches about probability, calibration, and the scams riding the hype.
A DLP Baseline for Small Teams: Stopping Leaks Without a SOC
7/12/2026
Data-loss prevention is usually sold as enterprise tooling. Here's a pragmatic baseline a small team can actually run, built on classification, identity, and a few high-leverage controls.
Threat-Modelling Your First MCP Server: STRIDE for the Agent Era
7/3/2026
MCP servers hand an AI agent real tools and real access. Here's how to run a classic STRIDE threat model over one before you wire it to anything that matters.
Machine Identity Is the New Perimeter
6/17/2026
Human logins are well defended. The unguarded door now is the service account, the API key, and the AI agent. A baseline for treating non-human identities as first-class.
PCI DSS 4.0, Part 2: How the 12 Requirements Ladder Up to 6 Goals
6/13/2026
A practitioner's map of PCI DSS 4.0: the 6 control objectives, the 12 requirements beneath them, and how to read the standard as a security model rather than a checklist.
Building Sakinah: An App for the Hardest Moment
6/8/2026
I built Sakinah to help Muslim families in Singapore through the hours after a death. The decisions I'm surest about weren't features: they were the things I chose not to build, hold, or collect.
Governing AI Agents: When the User Isn't a Person Anymore
6/8/2026
Agentic AI breaks the assumption that every action traces back to a human. Here's a baseline for giving agents identity, scope, and accountability.
Learning Log: PCI DSS 4.0 Fundamentals
9/7/2025
Notes from my deep dive into PCI DSS 4.0 fundamentals, with a plan for my next stage of study.
Why Side Quests?
9/7/2025
A space for the random challenges, experiments, and reflections that don’t fit neatly into my main work.
The Lethal Trifecta: Setting Secure AI Baselines for Organisations
9/1/2025
Simon Willison’s ‘lethal trifecta’ and how to turn it into an enterprise baseline.
Learning Log: Terminal & Plugin Setup Journey
8/24/2025
Customising my Zsh environment with Powerlevel10k, fzf, zsh-autosuggestions, and zsh-z: lessons learned along the way.
Week 34: Notes
8/23/2025