How to Lead a Review of Network Detection Engineering
A practical security engineering field guide to network detection engineering, covering risk, implementation, evidence, and team leadership.
Nathan Berg
RAG Access Control with Attribute-Based Authorization
Role-based controls are often too coarse for retrieval systems. Two users with the same role may still require different document visibility based on region, project, or data classification. Attri...
Measuring Network Detection Engineering Without Vanity Metrics
A practical security engineering field guide to network detection engineering, covering risk, implementation, evidence, and team leadership.
Turning Requirements for Network Detection Engineering into Delivery Guardrails
A practical security engineering field guide to network detection engineering, covering risk, implementation, evidence, and team leadership.
Policy as Code for LLM Prompts and n8n Flows
Prompt text and automation logic now carry business risk similar to application code. Yet many teams still manage them through ad hoc edits in UI tools with minimal review. Treating prompts and n8...
Designing Network Detection Engineering: Trust Boundaries, Failure Modes, and Tradeoffs
A practical security engineering field guide to network detection engineering, covering risk, implementation, evidence, and team leadership.
A Practical Risk Model for Network Detection Engineering
A practical security engineering field guide to network detection engineering, covering risk, implementation, evidence, and team leadership.
A Practical Failure Exercise for SIEM Architecture
A practical security engineering field guide to siem architecture, covering risk, implementation, evidence, and team leadership.
SIEM Architecture in Production: Signals That Show the Control Works
A practical security engineering field guide to siem architecture, covering risk, implementation, evidence, and team leadership.
Canary Tokens for RAG Exfiltration Detection
RAG exfiltration often looks like normal usage until it is too late. Attackers can ask repeated reformulated questions that gradually reconstruct sensitive data. Canary markers give you early warn...