-
Digital Provenance as a Trust and Compliance Requirement
For most of computing history, trust was implicit. You installed the package from npm because it was on npm. You believed the photo in your feed because photos were hard to fake convincingly. You trusted the data in your warehouse because someone you knew had loaded it. None of that trust was verified — it was assumed, because forging the alternative was expensive or obvious. That assumption has collapsed on three fronts simultaneously, and the collapse is why digital provenance — the verifiable record of a digital asset’s origin, authorship, modifications, and chain of custody — has gone from a… Go to Post
-
Pre-emptive Cybersecurity
Security has one brutal piece of arithmetic at its core: defenders must be right every time; attackers only need to be right once. For decades the response to that asymmetry was reactive — build taller walls, install faster alarms, and when something gets through, detect and respond. Detection-and-response (D&R) is the model that gave us SIEMs, SOCs, EDR, and the entire incident-response playbook. It works by waiting for an attack to begin, then reacting. In 2026, that model is buckling, and the reason is speed. Machine-speed attacks broke the reactive window The reactive model depends on a window: the time… Go to Post
-
New AI-Era Attack Vectors
For years the most effective attackers have avoided bringing malware at all. Why smuggle in a payload your EDR will flag when the target machine already ships with everything you need? This is living off the land (LOTL): abusing legitimate, pre-installed tools — PowerShell, WMI, signed system binaries (“LOLBins”) — to operate. Because the tools are allowlisted and the activity looks normal, LOTL leaves no malware signature and blends into routine operations. By 2023, CrowdStrike reported that roughly 6 in 10 detections involved LOTL techniques rather than traditional malware. It works because the safest tool to attack with is one… Go to Post
-
Securing the Agent Harness
Start with a number. An agent that opens 1,000 pull requests a week at a 1% vulnerability rate ships 10 new vulnerabilities every week — quietly, confidently, indefinitely. That’s the uncomfortable arithmetic of autonomy: a small per-action error rate, multiplied by machine-speed volume, becomes a steady stream of security holes. A human writing ten PRs a day can’t produce vulnerabilities fast enough to matter at that scale. An agent fleet can. This reframes the whole problem. Security for AI agents isn’t a model-quality question you can solve with a better prompt. It’s a systems question, and the answer to “how… Go to Post
-
Agentic Engineering: From Vibe Coding to a Plan, Execute, Verify Discipline
For about a year, “vibe coding” was the most fun anyone had had with a keyboard. You describe what you want, an agent writes it, you skim the result, you ship. Andrej Karpathy’s original framing was almost gleeful: you “give in to the vibes” and barely read the diffs. Then teams tried to put vibe-coded software into production, and the bill came due. The failure mode now has a name — AI slop: code that looks reasonable on the surface but lacks error handling, quietly introduces security vulnerabilities, breaks something three modules over, or produces an architecture nobody can maintain.… Go to Post
-
Eyes Everywhere: Secure Logging and Alerting for Modern Systems – Part III
Logging and alerting become truly powerful only when they are embedded into a well-designed security architecture. Individual applications emitting logs or isolated detection rules provide only partial visibility. Modern organisations operate distributed systems composed of microservices, cloud infrastructure, container platforms, and external APIs. In such environments, security visibility requires a unified architecture capable of collecting, analysing, and responding to telemetry across the entire system. Designing Systems That Detect and Respond to Threats A secure observability architecture combines several layers. Applications generate structured logs. Infrastructure produces telemetry about hosts, containers, and network activity. These signals are collected and aggregated through centralized… Go to Post
-
Eyes Everywhere: Secure Logging and Alerting for Modern Systems – Part II
Logging is the foundation of security visibility, but logs alone do not defend systems. A modern production environment may generate millions or even billions of log entries per day. Hidden within this massive stream of telemetry are the signals that reveal active attacks, compromised accounts, and data exfiltration attempts. Without intelligent processing, these signals remain buried inside an ocean of noise. Alerting transforms raw logs into actionable intelligence. It is the mechanism through which suspicious events are detected, prioritized, and escalated to the people or systems capable of responding. In a mature security architecture, logging produces the raw telemetry, while… Go to Post
-
Eyes Everywhere: Secure Logging and Alerting for Modern Systems – Part I
Modern software systems generate an enormous stream of operational data. Every authentication attempt, database query, API request, container deployment, and network connection leaves a digital trace somewhere inside the infrastructure. Historically, developers treated these traces primarily as troubleshooting aids—temporary clues to diagnose bugs when something went wrong. In contemporary security engineering, however, logs serve a far more profound purpose. Logs are now a primary sensor layer for detecting attacks. The Role of Logging in Modern Security In early software systems, logging existed primarily to support debugging. Developers would emit messages describing program execution so they could understand failures during development… Go to Post
Professional Developer
by Rodrigo Silva
