Vulnerability management / AI / agents
Security Is All About Context
Practical security thinking for systems that increasingly write, deploy, and operate themselves. Fewer buzzwords. Better evidence. Occasional memes.
Advisory desk
Known exploitation already skipped the prioritization meeting.
MLflow MLflow
An unauthenticated MLflow webhook test can follow redirects into internal services or cloud metadata endpoints and return their responses.
Microsoft Windows IKE Service Extensions
A critical double-free flaw in the Windows IKE service can allow an unauthenticated network attacker to execute code on a reachable system.
Microsoft SharePoint Server
A critical JWT authentication weakness can let an unauthenticated network attacker bypass SharePoint security controls and access protected data.
Browser tool / no upload
A secret scanner that keeps the source secret.
Inspect configuration, source, and logs locally. Findings include redacted context, a reasoned risk score, and practical rotation guidance.
Latest posts
For the work after the scanner finishes yelling.
A field guide to agentic vulnerability management (with an actual off switch)
A practical operating model for introducing agents without confusing automation, authority, and accountability.
Finding vulnerabilities is getting cheaper. The backlog has noticed.
AI compresses the cost of discovery, but the expensive parts of vulnerability management still begin after the finding exists.
The vulnerability ticket is an interface, not a filing cabinet
A useful vulnerability record should help an owner decide and act—not merely preserve scanner output.
