Decision domains
Start with the decision you need to make. Each article has one primary home; related technologies and practices remain easy to follow across domains.
See how the domains connectAccountability and capital
What matters, who owns it, and where should we invest?
Strategy, risk appetite, accountability, operating models, assurance, metrics, budgets, talent, and third-party governance.
A hidden instruction in a job posting tries to stop automated applications. Its targeting and false-confirmation request show why even a creative defense needs validation.
EPSS v5 arrived through the same interface, but its new score distribution could materially alter vulnerability queues, thresholds, capacity assumptions, and executive reporting.
A credible program must explain why an exposure matters, who owns the response, what uncertainty remains, and whether the decision reduced material risk.
When a risk model changes, the operational question is not whether the new numbers look better. It is whether your thresholds, workflows, and executive reporting still mean what you think they mean.
CVSS can describe severity, EPSS can estimate exploitation likelihood, and SSVC can structure response. Leadership still has to connect those signals to business exposure and accountable action.
Secure transformation
How do we build and adopt technology without hidden exposure?
Cloud and platform architecture, product security, data, identity architecture, trust boundaries, and secure-by-design engineering.
Deeper vulnerability analysis needs a dataset you can inspect and trust. Building NVD Harvester exposed the challenges of keeping it complete, current, and reliable—and the limits of NVD alone.
Shared GPU capacity can make local AI available without dedicating an expensive accelerator to one workload. The design question is how to balance efficiency, isolation, and operational risk.
AWX centralizes privileged automation, from vulnerability remediation to configuration checks. Its value depends on accountable identity, state, upgrades, and recovery.
Operational exposure
Where are we exposed, and which controls demonstrably change it?
Threats, vulnerability and exposure management, detection, response readiness, and operational control validation.
EPSS becomes useful when thresholds reflect risk appetite, remediation capacity, and business context—and when the program measures what those thresholds actually capture.
Continuity under pressure
Can the organization withstand disruption and recover reliably?
Disruption, concentration risk, crisis leadership, continuity, recoverability, and verified restoration.
After an update damaged both automation workflows and their internal backup path, I moved exports outside n8n. The failure exposed gaps in separation, secret handling, and restore testing.
When AWX orchestrates enterprise patching and security work, the automation platform itself needs a controlled, recoverable upgrade path.
The ESXi command is the smallest part of a safe update. Maintenance mode, rollback planning, compatibility review, and post-change evidence are the real controls.
