• Posts

Threat Modeling Agents with MAESTRO: The Danger Is in the Hops, Not the Boxes

STRIDE asks what can go wrong with an element. An agent is a process, a data store, a data flow and an actor at the same time, so the question stops parsing. A full seven-layer model of a system that clears supplier invoices — and the six-hop chain that paid one, with every control green.

• Agentic Security
• Threat Modeling
• MAESTRO
• Secure by Design
• Guardrails

Friday, September 11, 2026 | 22 minutes Read

Majlis: Giving Agents Your Life Data Without Giving Them the Key

Majlis is a council of AI advisors for your life rather than your codebase. The interesting part is not the personas — it is that agents write to a database holding health and finance data while never holding the passphrase and never opening the file.

• Open Source
• Agentic
• Claude Code
• SQLCipher
• SQLite
• Security Architecture

Wednesday, September 2, 2026 | 15 minutes Read

Securing AI-DLC: Process Integrity Is Not Product Security

AI-DLC gives you the strongest process integrity I have seen in any methodology — approval gates, audit shards, element-level traceability. None of it tells you the code is safe. Those are different claims, and closing the gap phase by phase is the work.

• AI-DLC
• Agentic Security
• Secure by Design
• Threat Modeling
• Guardrails

Monday, August 31, 2026 | 10 minutes Read

The Security Coach for AI Agents

Every team debating whether to trust the model has already made the decision that matters: where the boundary lives. A prompt is a promise. A tool interface is a constraint. Four patterns for telling them apart.

• Agentic Security
• LLM Security
• Threat Modeling
• Guardrails

Tuesday, August 25, 2026 | 8 minutes Read

Sitadel: What You Owe People Once a Distro Ships Your Tool

Eight years, 179 commits, and packaged in Kali and BlackArch — which I did not plan and which changed what I am allowed to break. On finding quality over detection coverage, a hang that only existed in a real terminal, and the cleanup nobody asks for.

• Open Source
• Python
• AppSec
• Scanner
• Maintenance

Tuesday, August 18, 2026 | 7 minutes Read

Watari: A Security Control That Was Never On

Watari’s headline claim is tenant isolation enforced by PostgreSQL Row-Level Security. The policies had been in the schema for months and had never once taken effect. Turning them on took four changes that had to land together — and none of them was writing a policy.

• Open Source
• Python
• PostgreSQL
• Multi-tenancy
• Incident Response
• OCSF

Tuesday, August 11, 2026 | 9 minutes Read

• ««
• «
• 1
• 2
• 3
• »
• »»