Posts
All the articles I've posted.
- 3 min read
DAST with OWASP ZAP in CI/CD Pipelines
Dynamic Application Security Testing often gets skipped because it's hard to automate. Here's how to integrate OWASP ZAP into your pipeline without it becoming a blocker.
- 3 min read
EPSS: A Smarter Way to Prioritize CVEs
CVSS scores alone are a poor guide for prioritization. EPSS uses real exploit data to tell you what's actually being exploited in the wild — and that changes everything.
- 4 min read
Zero Trust Security for Microservices
What Zero Trust actually means in a microservices architecture — and how to implement it with service mesh, mTLS, and workload identity.
- 3 min read
Hardening GitHub Actions Workflows
GitHub Actions is powerful and widely trusted — which makes misconfigured workflows a high-value attack target. Here's how to lock them down.
- 3 min read
Software Supply Chain Security and SBOMs
What SBOMs actually are, why they matter after Log4Shell and SolarWinds, and how to generate and use them in practice.
- 3 min read
Secrets Management in CI/CD Pipelines
How to stop treating secrets as an afterthought in your pipelines — and what actually works in practice.
- 5 min read
Why I Started Building ScanDog
After a decade of security engineering and watching teams drown in vulnerability noise, I decided to build the tool I always wished existed.
- 6 min read
Deep Dive into Tetragon
Deep Dive into Tetragon: eBPF-Based Security Observability and Runtime Enforcement
- 3 min read
About OWASP Threat Dragon
A comprehensive overview of OWASP Threat Dragon, an open-source threat modeling tool for security teams
- 4 min read
Comparing four popular Kubernetes policy engines
A comprehensive comparison of OPA Gatekeeper, Kyverno, Kubewarden, and jsPolicy for Kubernetes policy enforcement