Cloud security
Server-side reachability, workload identity, effective IAM permissions, and the paths that connect them.
Start here, then go deeper.
Trace server-side reachability into workload identity and effective cloud permissions.
- 01ReachabilityThe Request Stayed Server-Side. The Credential Did Not.9 min ↗
SSRF severity is not the URL an application can fetch. It is the trust the outbound request inherits — network position, redirect behavior, DNS resolution, and access to metadata or control-plane identities. Test the route as a chain, not a blacklist.
- 02Workload identityThe Pipeline Has No Secret. It Still Has a Cloud Identity.8 min ↗
Replacing static deployment keys with OIDC removes a credential from the repository. It does not decide which workflow deserves the resulting cloud role — that decision lives in the trust policy, and one wildcard can turn an organisation into a deployment API.
- 03Effective authorityCloud IAM Privilege Escalation: Every Permission Is Individually Fine. The Chain Is Not.9 min ↗
CSPM and least-privilege tools grade each IAM policy on its own, and on its own nearly every policy passes. Cloud privilege escalation is a path across roles, accounts, and trust — and a scanner that cannot see the path cannot flag the risk.
Every matching record.
Methods and named-vulnerability research remain visually and editorially separate.
Field notes 6
The Vendor Was Out of Scope. The Trust Boundary Was Not.
A third-party platform may be excluded from testing while the customer-controlled trust decisions around it remain assessable: identity claims, callbacks, webhooks, custom domains, delivery paths, and data flows.
16 min read ↗Pentest · Aug 29, 2026The External Perimeter Is a Graph. The Port List Is Only One View.
Modern external pentesting starts by proving how domains, companies, certificates, identity systems, cloud services, and third parties relate. Active scanning then verifies the small part of that graph that is both relevant and authorized.
14 min read ↗Pentest · Jul 9, 2026The Model Is Not the Target. The Pipeline Is.
A field methodology for using MITRE ATLAS without turning an AI assessment into matrix theatre: map the production system, follow authority into tools and data, test reachable attack paths, and label the evidence only after impact is proven.
18 min read ↗Cloud Security · Apr 16, 2026The Pipeline Has No Secret. It Still Has a Cloud Identity.
Replacing static deployment keys with OIDC removes a credential from the repository. It does not decide which workflow deserves the resulting cloud role — that decision lives in the trust policy, and one wildcard can turn an organisation into a deployment API.
8 min read ↗Web Security · Jan 29, 2026The Request Stayed Server-Side. The Credential Did Not.
SSRF severity is not the URL an application can fetch. It is the trust the outbound request inherits — network position, redirect behavior, DNS resolution, and access to metadata or control-plane identities. Test the route as a chain, not a blacklist.
9 min read ↗Cloud Security · Aug 14, 2025Cloud IAM Privilege Escalation: Every Permission Is Individually Fine. The Chain Is Not.
CSPM and least-privilege tools grade each IAM policy on its own, and on its own nearly every policy passes. Cloud privilege escalation is a path across roles, accounts, and trust — and a scanner that cannot see the path cannot flag the risk.
9 min read ↗