AI Agents in the SOC: Useful Work, Human Review and the Maturity Gap
AI can enrich, summarize and prioritize SOC work. It still needs human review, outcome sampling and an operating model that can catch quiet failures.
TECHNICAL NOTES · PERSONALLY PUBLISHED
Security operations, identity and AI systems.
The archive contains source-linked threat research, KQL, implementation guides and technical notes. I maintain and publish it personally.
ARCHIVE
All writing
11 published notes
OWASP Agentic AI Top 10: A Practical Control Map for Running Agents
The official OWASP list names ten risks for agentic applications. This guide maps each category to a control you can test.
Palo Alto Networks Completed the CyberArk Acquisition. What Identity Teams Should Check.
Palo Alto Networks completed its CyberArk acquisition on February 11, 2026. The practical question is how the combined ownership changes privileged-access planning.
AI Security Readiness: Turn Survey Concern Into an Operating Plan
Darktrace reports a gap between perceived AI threat impact and preparedness among surveyed security professionals. Close it with inventory, telemetry, playbooks, exercises and named ownership.
Moltbook Exposure: What Wiz Actually Found
Wiz found unauthenticated read and write access to Moltbook's production database. The confirmed scope was 1.5 million authentication tokens, 35,000 email addresses and 4,060 private DM conversations.
AI Agent Identity: Inventory, Scope and Revoke
AI agents use machine credentials to act across APIs and tools. The security work is concrete: identify each agent, bind it to an owner, limit its authority, log its actions and remove access when the use case ends.
Hunting Sliver behavior with Defender XDR and Sentinel
A source-based guide to hunting default Sliver execution and process-injection behavior with Microsoft Defender XDR.
CVE-2025-68664 in langchain-core: patch and exposure review
A source-based guide to the langchain-core serialization injection flaw, patched versions and practical exposure review.
Secure AI Adoption: Start With the Data Path
Microsoft's 2026 Data Security Index shows a control gap among surveyed organizations. This is a practical Microsoft security sequence for finding AI use, reducing data exposure and handling incidents.
SharePoint AiTM phishing: detection and response in Defender XDR
A source-based response note for the SharePoint phishing, AiTM session theft and BEC chain documented by Microsoft.
Hunting TA584 and Tsundere Bot in Defender XDR
A source-based Defender XDR hunting note for Proofpoint's TA584 ClickFix chain and the Tsundere Bot payload.