EPSS v5 Changed the Queue Without Changing the Integration
EPSS v5 arrived through the same interface, but its new score distribution could materially alter vulnerability queues, thresholds, capacity assumptions, and executive reporting.
Decision domains
Explore security through four connected decisions.
Start with the decision you need to make. Each article has one primary home; related technologies and practices remain easy to follow across domains.
See how the domains connectAccountability and capital
Govern & Invest
What matters, who owns it, and where should we invest?
Strategy, risk appetite, accountability, operating models, assurance, metrics, budgets, talent, and third-party governance.
What Executives Should Demand from Vulnerability Prioritization
A credible program must explain why an exposure matters, who owns the response, what uncertainty remains, and whether the decision reduced material risk.
EPSS v4 Changed the Scores. The Leadership Lesson Was Model Governance
When a risk model changes, the operational question is not whether the new numbers look better. It is whether your thresholds, workflows, and executive reporting still mean what you think they mean.
Vulnerability Management Is a Decision System, Not a Patch Queue
CVSS can describe severity, EPSS can estimate exploitation likelihood, and SSVC can structure response. Leadership still has to connect those signals to business exposure and accountable action.
Secure transformation
Architect & Build
How do we build and adopt technology without hidden exposure?
Cloud and platform architecture, product security, data, identity architecture, trust boundaries, and secure-by-design engineering.
Local AI on Proxmox: The Security Tradeoffs Behind GPU-Enabled LXC
GPU passthrough can turn older hardware into a capable local-AI environment. The useful design question is what efficiency, isolation, and operational risk you are willing to trade.
Running AWX on MicroK8s: What a Small Automation Platform Still Requires
A lab-sized AWX deployment is easy to start and surprisingly instructive to operate. The important work begins with state, access, upgrades, and recovery.
Random Passwords from the Shell: A Small Tool with Security Boundaries
A secure random string is useful in a lab, but generation is only one part of credential security. Here is a practical shell pattern and the limits that matter.
Operational exposure
Defend & Detect
Where are we exposed, and which controls demonstrably change it?
Threats, vulnerability and exposure management, detection, response readiness, and operational control validation.
Operationalizing EPSS Without Turning Probability into Policy by Accident
EPSS becomes useful when thresholds reflect risk appetite, remediation capacity, and business context—and when the program measures what those thresholds actually capture.
Bash History Is Operational Memory—and Sometimes Sensitive Data
A cleaner shell history improves retrieval, but the more important design question is what should be retained, synchronized, or removed in the first place.
Continuity under pressure
Resilience & Recovery
Can the organization withstand disruption and recover reliably?
Disruption, concentration risk, crisis leadership, continuity, recoverability, and verified restoration.
A Backup That Depends on n8n Is Not an Independent Control
After an update damaged both automation workflows and their internal backup path, I moved exports outside n8n. The failure exposed gaps in separation, secret handling, and restore testing.
Upgrading AWX on MicroK8s Without Treating the Operator as a Rollback Plan
An operator can automate an AWX upgrade, but it cannot decide whether your backups, capacity, compatibility, and recovery path are good enough.
Patching Standalone ESXi: A Lab Runbook Built Around Recovery
The ESXi command is the smallest part of a safe update. Maintenance mode, rollback planning, compatibility review, and post-change evidence are the real controls.
Recovering Ubuntu Boot Space Without Removing Your Recovery Path
Old kernels can fill a small boot volume, but cleanup should preserve a known-good fallback and use the package manager’s own dependency decisions.