PinnedCybersecurity — It’s All About TrustLast year, I wrote about the importance of understanding risks in cybersecurity and the critical role of risk reduction. Recently, I’ve…Dec 30, 2023A response icon4Dec 30, 2023A response icon4
Writing, Receiving, Reviewing: My Take on Penetration Test ReportsA penetration test report can build trust or destroy it.Sep 21Sep 21
GPT-5 vs Gemini Pro 2.5 vs Sonnet 4: Detecting Simple VulnerabilitiesTesting how GPT-5, Gemini Pro 2.5, and Sonnet 4 handle basic security flawsAug 17A response icon1Aug 17A response icon1
API Keys for Bedrock: A Brief Security OverviewBedrock now supports API keys. This post explores how they work and what security teams need to know.Jul 13Jul 13
OWASP Global AppSec Barcelona 2025 Personal RecapSuper-brief review of my notes and highlights from the talks I attendedJun 1Jun 1
TrailAlerts: Take Control of Cloud Detection in AWSIntroducing TrailAlerts: a serverless, open-source tool to define Sigma rules and get rich, customizable alerts from your AWS account.May 4A response icon1May 4A response icon1
Gaining Long-Term AWS Access with CodeBuild and GitHubDiscover how attackers can abuse AWS CodeBuild and GitHub Actions to gain stealthy persistence in compromised AWS environments.Apr 13Apr 13
GitHub Actions and the Pinning Problem: What 100 Security Projects RevealOnly 7/100 popular security projects pin everything. Here’s what I learned digging into the data.Mar 29A response icon1Mar 29A response icon1
DIY — Evaluating AWS Native Approaches for Detecting Suspicious API CallsWhile in my previous articles from the DIY series, I explored how to build solutions with LLMs (Using Semgrep with LLMs and Building a…Mar 2A response icon1Mar 2A response icon1
DIY — Using Semgrep with LLMs to Improve Code ReviewsDIY code reviews: Using open-source Semgrep + AWS Bedrock AI to auto-suggest fixes for vulnerabilities.Feb 22Feb 22