Independent perspectives on security, technology, and risk
A hidden instruction in a job posting tries to stop automated applications. Its targeting and false-confirmation request show why even a creative defense needs validation.
Read the latest insightThe Depth Map
The same themes resurface in how you govern, how you build, and how you recover. The map traces where that overlap shows up across published work.
Open the Depth MapContinuous improvement
The most recent lesson from each decision domain.
Offensive techniques can inspire useful defenses. Define the abuse, preserve legitimate access and truthful outcomes, and test every security control against its intended behavior.From: Offense as Defense: Why a Clever AI Prompt-Injection Control Still Needs Validation
Build integrity checks and verified recovery into data workflows, with periodic human spot checks and clear ownership of unresolved failures. Efficient updates must preserve trust; NVD data still needs threat, exposure, and business context to support remediation priorities.From: NVD Harvester: A Foundation for Vulnerability Analysis
EPSS improves prioritization when probability informs policy alongside known exploitation, reachability, business consequence, control strength, and remediation capacity.From: Operationalizing EPSS Without Turning Probability into Policy by Accident
A backup inside the same failure domain is not an independent control; recovery evidence requires separated artifacts, protected secrets, and repeated restore tests.From: A Backup That Depends on n8n Is Not an Independent Control
Latest insights
Security strategy, architecture, active defense, and recovery—examined through the systems that have to deliver them.
Deeper vulnerability analysis needs a dataset you can inspect and trust. Building NVD Harvester exposed the challenges of keeping it complete, current, and reliable—and the limits of NVD alone.
EPSS v5 arrived through the same interface, but its new score distribution could materially alter vulnerability queues, thresholds, capacity assumptions, and executive reporting.
After an update damaged both automation workflows and their internal backup path, I moved exports outside n8n. The failure exposed gaps in separation, secret handling, and restore testing.
A credible program must explain why an exposure matters, who owns the response, what uncertainty remains, and whether the decision reduced material risk.
EPSS becomes useful when thresholds reflect risk appetite, remediation capacity, and business context—and when the program measures what those thresholds actually capture.
