Threat Hunting: What the Team Must Decide Before Building
A practical security engineering field guide to threat hunting, covering risk, implementation, evidence, and team leadership.
Nathan Berg
How to Lead a Review of Security Logging and Telemetry
A practical security engineering field guide to security logging and telemetry, covering risk, implementation, evidence, and team leadership.
Vector Database Isolation for Multi-Tenant AI Systems
Multi-tenant RAG architectures often fail at one point: retrieval isolation. Teams enforce auth on the API layer but forget that nearest-neighbor search can still surface embeddings from another te...
Measuring Security Logging and Telemetry Without Vanity Metrics
A practical security engineering field guide to security logging and telemetry, covering risk, implementation, evidence, and team leadership.
Turning Requirements for Security Logging and Telemetry into Delivery Guardrails
A practical security engineering field guide to security logging and telemetry, covering risk, implementation, evidence, and team leadership.
Designing Security Logging and Telemetry: Trust Boundaries, Failure Modes, and Tradeoffs
A practical security engineering field guide to security logging and telemetry, covering risk, implementation, evidence, and team leadership.
Defending RAG Pipelines from Data Poisoning
Data poisoning in RAG is usually subtle. Attackers do not need to corrupt all documents; they only need to influence the chunks most likely to be retrieved for sensitive prompts. That means ingest...
A Practical Risk Model for Security Logging and Telemetry
A practical security engineering field guide to security logging and telemetry, covering risk, implementation, evidence, and team leadership.
A Practical Failure Exercise for Detection Engineering
A practical security engineering field guide to detection engineering, covering risk, implementation, evidence, and team leadership.
RAG Threat Modeling: Prompt Injection to Data Exfiltration
RAG systems are often secured like search features, but they behave like decision engines. Retrieved content can influence model behavior, tool execution, and what data is returned to the user. A ...