~/a-security-engineer

$ archives

# All the articles I've archived.

2026 ³

April ¹

The Rise of Supply Chain Attacks: Why 2025–2026 Changed Everything

20 Apr, 2026

Supply chain attacks have evolved from rare, high-profile incidents into industrialized, automated campaigns targeting the open-source ecosystem at scale. The software supply chain is no longer a side door — it's the primary attack surface of the modern era.

March ¹

Introducing OWASP ThreatAtlas: Collaborative Threat Modeling at Scale

28 Mar, 2026

An introduction to OWASP ThreatAtlas — a collaborative platform for creating, tracking, and mitigating application threats — and the story behind initiating the project.

January ¹

DAST with OWASP ZAP in CI/CD Pipelines

14 Jan, 2026

Dynamic Application Security Testing often gets skipped because it's hard to automate. Here's how to integrate OWASP ZAP into your pipeline without it becoming a blocker.

2025 ⁷

December ¹

EPSS: A Smarter Way to Prioritize CVEs

15 Dec, 2025

CVSS scores alone are a poor guide for prioritization. EPSS uses real exploit data to tell you what's actually being exploited in the wild — and that changes everything.

November ²

October ¹

Software Supply Chain Security and SBOMs

9 Oct, 2025

What SBOMs actually are, why they matter after Log4Shell and SolarWinds, and how to generate and use them in practice.

September ¹

Secrets Management in CI/CD Pipelines

18 Sep, 2025

How to stop treating secrets as an afterthought in your pipelines — and what actually works in practice.

March ¹

Why I Started Building ScanDog

15 Mar, 2025

After a decade of security engineering and watching teams drown in vulnerability noise, I decided to build the tool I always wished existed.

February ¹

Deep Dive into Tetragon

11 Feb, 2025

Deep Dive into Tetragon: eBPF-Based Security Observability and Runtime Enforcement

2023 ²

June ¹

About OWASP Threat Dragon

13 Jun, 2023

A comprehensive overview of OWASP Threat Dragon, an open-source threat modeling tool for security teams

April ¹

Comparing four popular Kubernetes policy engines

12 Apr, 2023

A comprehensive comparison of OPA Gatekeeper, Kyverno, Kubewarden, and jsPolicy for Kubernetes policy enforcement

2022 ¹

April ¹

Azure Sentinel – logs retention

4 Apr, 2022

How to keep logs as cold logs after 90 days in Azure Sentinel using Azure Logic Apps

2021 ³

August ²

May ¹

OWASP DevSecOps Guideline Project

7 May, 2021

An overview of the OWASP DevSecOps Guideline project — what it covers, why we built it, and how to get involved.